From d711c593deba364b8e4c4fa9855ae294ab08abc5 Mon Sep 17 00:00:00 2001 From: Gabriele Gristina Date: Mon, 26 Jul 2021 23:00:33 +0200 Subject: [PATCH] fix to crack real hashes --- OpenCL/m26800-pure.cl | 6 +++--- src/modules/module_26800.c | 35 +++++++++++++++++++++-------------- tools/test_modules/m26800.pm | 6 +++--- 3 files changed, 27 insertions(+), 20 deletions(-) diff --git a/OpenCL/m26800-pure.cl b/OpenCL/m26800-pure.cl index 5e3a97c89..9b37fb5d0 100644 --- a/OpenCL/m26800-pure.cl +++ b/OpenCL/m26800-pure.cl @@ -18,7 +18,7 @@ #define COMPARE_M "inc_comp_multi.cl" #define SNMPV3_SALT_MAX 1500 -#define SNMPV3_ENGINEID_MAX 32 +#define SNMPV3_ENGINEID_MAX 34 #define SNMPV3_MSG_AUTH_PARAMS_MAX 24 #define SNMPV3_ROUNDS 1048576 #define SNMPV3_MAX_PW_LENGTH 64 @@ -158,10 +158,10 @@ KERNEL_FQ void m26800_loop (KERN_ATTR_TMPS_ESALT (hmac_sha256_tmp_t, snmpv3_t)) #define SNMPV3_TMP_ELEMS_OPT 1024 // 1024 = (64 max pw length * 64) / sizeof (u32) // for pw length > 64 we use global memory reads - u32 tmp[SNMPV3_TMP_ELEMS_OPT]; - if (pw_len < 64) { + u32 tmp[SNMPV3_TMP_ELEMS_OPT]; + for (int i = 0; i < pw_len64 / 4; i++) { tmp[i] = tmps[gid].tmp[i]; diff --git a/src/modules/module_26800.c b/src/modules/module_26800.c index a83d3d60c..1eb4aac43 100644 --- a/src/modules/module_26800.c +++ b/src/modules/module_26800.c @@ -24,8 +24,8 @@ static const u64 KERN_TYPE = 26800; static const u32 OPTI_TYPE = OPTI_TYPE_ZERO_BYTE; static const u64 OPTS_TYPE = OPTS_TYPE_PT_GENERATE_LE; static const u32 SALT_TYPE = SALT_TYPE_EMBEDDED; -static const char *ST_PASS = "hashcat"; -static const char *ST_HASH = "$SNMPv3$4$45889431$7585276599737564090383620785875362679570918402799211895350192983610621799047885344685052349746498170004419679809998081225537660774711595828022661503055854170724959205864916200803943987403894797803763481363727292279225961510615959487947720856537753019855530297295056779122144350124168183779842820374286984757533892647079640573333153143396873669433866800344639810381298050168882378150279566459307666090519521322815302807234891775832544445039651641425655552560443188806182642324260074431487445313192652657250751370429453104201042515913762789378530433301986580350004818693362476848691871673675659445549903680506046990324666901673291971652166488315974132495137618778248693199870322191689838829962702758419523119691721384156190269307593610430479672423773038949589918013851098014826303025169209691104391100698448756709167376495619227358406074004239019720054426442537351811110592798309899798157050114783730510485144587168960689222637040407284798304089491802615462370291323816279667792138184578665760500558880678181062362046229800381787440035656017470040087753144990921393458116599087055670067264879913812409968391970564185904377677084151443486003356616003528495750605129080488541279404701230256406769537633540790538993840001994448667033186814369838617950258925646831255009214425619864849786889274339803369923741038433445561276156132523400238192914216432204256425467734206133901586319913209169130225239005197164649118976947815053973991620162266974447853858458256357645692359369654447975747053244194895693264221530053171833268878231470099223799325721243415613411630825573731881407172997796505669046572568259071354047006445465146935309155702401448180827618102265276619554321281052975592010657285138946619551041266741457855926885313703662453134087502628246081150904608404970922549555759053744598264595885136892607797491556352245712414920090723217166690761677377687465170467631650187720861675760594906517486491314827635367948111347039584630077862097594777930458637889773296564015874734165862197875708654799960975367561065172801085838166681751675400275453999727992053489914032314886557511524110138141979947589094776031663264570900816201631633824654762248248805668317229291634483443458068978054635356784996769204180557000130172957152232863885190742315631622924490109766525818157610765334992830472354779514002105972270348518900692627110569460386663373886093497721570793034577661081462364460595701381729848934496026709342082328056794518778135826722253064384012917235631760724232491981271285825679491501595672776041021574940931247613127644522568100929407514262962178762077109203680576767235733058$8f58b2$5f38e6b85a1921eb118de1bcd1d8673848a657753ba97615"; +static const char *ST_PASS = "hashcat1"; +static const char *ST_HASH = "$SNMPv3$4$45889431$30819f020103301102047fc51818020300ffe304010102010304483046041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d32353604180000000000000000000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a22602040efec2600201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$36d655bfeb59e933845db47d719b68ac7bc59ec087eb89a0"; u32 module_attack_exec (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return ATTACK_EXEC; } u32 module_dgst_pos0 (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return DGST_POS0; } @@ -45,8 +45,8 @@ const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig, static const char *SIGNATURE_SNMPV3 = "$SNMPv3$4$"; #define SNMPV3_SALT_MAX 1500 -#define SNMPV3_ENGINEID_MAX 32 -#define SNMPV3_MSG_AUTH_PARAMS_MAX 24 +#define SNMPV3_ENGINEID_MAX 34 +#define SNMPV3_MSG_AUTH_PARAMS_LEN 24 #define SNMPV3_ROUNDS 1048576 #define SNMPV3_MAX_PW_LENGTH 64 @@ -57,12 +57,12 @@ static const char *SIGNATURE_SNMPV3 = "$SNMPv3$4$"; #define SNMPV3_MAX_ENGINE_ELEMS 16 // 16 * 4 = 64 > 32, also has to be multiple of 64 #define SNMPV3_MAX_PNUM_ELEMS 4 // 4 * 4 = 16 > 9 -typedef struct hmac_sha224_tmp +typedef struct hmac_sha256_tmp { u32 tmp[SNMPV3_TMP_ELEMS]; u32 h[SNMPV3_HASH_ELEMS]; -} hmac_sha224_tmp_t; +} hmac_sha256_tmp_t; typedef struct snmpv3 { @@ -76,6 +76,13 @@ typedef struct snmpv3 } snmpv3_t; +u32 module_pw_min (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) +{ + const u32 pw_min = 8; + + return pw_min; +} + u64 module_esalt_size (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { const u64 esalt_size = (const u64) sizeof (snmpv3_t); @@ -85,7 +92,7 @@ u64 module_esalt_size (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED u64 module_tmp_size (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { - const u64 tmp_size = (const u64) sizeof (hmac_sha224_tmp_t); + const u64 tmp_size = (const u64) sizeof (hmac_sha256_tmp_t); return tmp_size; } @@ -130,23 +137,23 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE token.attr[1] = TOKEN_ATTR_VERIFY_LENGTH | TOKEN_ATTR_VERIFY_DIGIT; // salt - token.len_min[2] = 24 * 2; + token.len_min[2] = SNMPV3_MSG_AUTH_PARAMS_LEN * 2; token.len_max[2] = SNMPV3_SALT_MAX * 2; token.sep[2] = '$'; token.attr[2] = TOKEN_ATTR_VERIFY_LENGTH | TOKEN_ATTR_VERIFY_HEX; // engineid - token.len_min[3] = 5; + token.len_min[3] = 26; token.len_max[3] = SNMPV3_ENGINEID_MAX; token.sep[3] = '$'; - token.attr[3] = TOKEN_ATTR_VERIFY_LENGTH; + token.attr[3] = TOKEN_ATTR_VERIFY_LENGTH + | TOKEN_ATTR_VERIFY_HEX; // digest - token.len_min[4] = SNMPV3_MSG_AUTH_PARAMS_MAX * 2; - token.len_max[4] = SNMPV3_MSG_AUTH_PARAMS_MAX * 2; + token.len[4] = SNMPV3_MSG_AUTH_PARAMS_LEN * 2; token.sep[4] = '$'; - token.attr[4] = TOKEN_ATTR_VERIFY_LENGTH + token.attr[4] = TOKEN_ATTR_FIXED_LENGTH | TOKEN_ATTR_VERIFY_HEX; const int rc_tokenizer = input_tokenizer ((const u8 *) line_buf, line_len, &token); @@ -324,7 +331,7 @@ void module_init (module_ctx_t *module_ctx) module_ctx->module_potfile_keep_all_hashes = MODULE_DEFAULT; module_ctx->module_pwdump_column = MODULE_DEFAULT; module_ctx->module_pw_max = MODULE_DEFAULT; - module_ctx->module_pw_min = MODULE_DEFAULT; + module_ctx->module_pw_min = module_pw_min; module_ctx->module_salt_max = MODULE_DEFAULT; module_ctx->module_salt_min = MODULE_DEFAULT; module_ctx->module_salt_type = module_salt_type; diff --git a/tools/test_modules/m26800.pm b/tools/test_modules/m26800.pm index 5ea4fb87a..3039afb6b 100644 --- a/tools/test_modules/m26800.pm +++ b/tools/test_modules/m26800.pm @@ -11,14 +11,14 @@ use warnings; use Digest::SHA qw (sha256 sha256_hex); use Digest::HMAC qw (hmac hmac_hex); -sub module_constraints { [[1, 256], [48, 3000], [-1, -1], [-1, -1], [-1, -1]] } +sub module_constraints { [[8, 256], [48, 3000], [-1, -1], [-1, -1], [-1, -1]] } sub module_generate_hash { my $word = shift; my $salt = shift; - my $pkt_num = shift // int(rand(99999999)); - my $engineID = shift // random_hex_string(6); + my $pkt_num = shift // int(rand(100000000)); + my $engineID = shift // random_hex_string(26, 34); # make even if needed