mirror of https://github.com/hashcat/hashcat.git
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
290 lines
7.6 KiB
290 lines
7.6 KiB
#!/usr/bin/env perl
|
|
|
|
##
|
|
## Author......: See docs/credits.txt
|
|
## License.....: MIT
|
|
##
|
|
|
|
# for this hashcat extraction tool the input should be a export/dump of the registry key
|
|
# [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin Security\1]
|
|
#
|
|
# "reg export" cmd command can be used for this:
|
|
# reg export "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin Security\1" radmin3_export.reg
|
|
#
|
|
# Note: this tool is intentionally not designed to do an automatic registry key read
|
|
# but this could be done easily also in software/perl:
|
|
# use Win32::TieRegistry (Delimiter => '/');
|
|
# my $reg_key = $Registry->{'HKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Radmin/v3.0/Server/Parameters/Radmin Security'};
|
|
# my $file_content = $reg_key->{'/1'};
|
|
#
|
|
# An example input file (first command line parameter):
|
|
#
|
|
# [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin Security\1]
|
|
# "1"=hex:10,00,00,0a,72,00,6f,00,67,00,65,00,72,00,30,00,01,00,98,47,fc,7e,0f,\
|
|
# 89,1d,fd,5d,02,f1,9d,58,7d,8f,77,ae,c0,b9,80,d4,30,4b,01,13,b4,06,f2,3e,2c,\
|
|
# ec,58,ca,fc,a0,4a,53,e3,6f,b6,8e,0c,3b,ff,92,cf,33,57,86,b0,db,e6,0d,fe,41,\
|
|
# 78,ef,2f,cd,2a,4d,d0,99,47,ff,d8,df,96,fd,0f,9e,29,81,a3,2d,a9,55,03,34,2e,\
|
|
# ca,9f,08,06,2c,bd,d4,ac,2d,7c,df,81,0d,b4,db,96,db,70,10,22,66,26,1c,d3,f8,\
|
|
# bd,d5,6a,10,2f,c6,ce,ed,bb,a5,ea,e9,9e,61,27,bd,d9,52,f7,a0,d1,8a,79,02,1c,\
|
|
# 88,1a,e6,3e,c4,b3,59,03,87,f5,48,59,8f,2c,b8,f9,0d,ea,36,fc,4f,80,c5,47,3f,\
|
|
# db,6b,0c,6b,db,0f,db,af,46,01,f5,60,dd,14,91,67,ea,12,5d,b8,ad,34,fd,0f,d4,\
|
|
# 53,50,de,c7,2c,fb,3b,52,8b,a2,33,2d,60,91,ac,ea,89,df,d0,6c,9c,4d,18,f6,97,\
|
|
# 24,5b,d2,ac,92,78,b9,2b,fe,7d,ba,fa,a0,c4,3b,40,a7,1f,19,30,eb,c4,fd,24,c9,\
|
|
# e5,a2,e5,a4,cc,f5,d7,f5,15,44,d7,0b,2b,ca,4a,f5,b8,d3,7b,37,9f,d7,74,0a,68,\
|
|
# 2f,40,00,00,01,05,50,00,00,20,f9,89,48,2b,a8,3b,63,45,fd,1d,d7,e2,13,13,dc,\
|
|
# d5,55,22,ba,57,15,b5,79,ea,b8,74,d7,64,33,92,8d,72,60,00,01,00,01,2a,1b,fd,\
|
|
# 53,4a,88,d9,19,40,70,e6,1e,76,07,fd,69,90,94,ea,b6,3b,53,b2,76,6b,0c,f3,5e,\
|
|
# 73,fb,cc,21,41,ae,d3,28,1f,64,ca,62,0b,27,95,1c,f5,e2,c2,78,60,37,54,27,5f,\
|
|
# c1,63,51,ee,f0,8f,bb,e3,0c,f5,d9,27,be,c5,61,e5,ea,98,a6,df,a1,ee,e9,00,4b,\
|
|
# 00,83,4f,d9,ca,d5,ae,59,1e,ef,4f,c8,8b,f9,73,75,04,d2,9e,c5,93,34,6c,cd,1d,\
|
|
# 76,18,82,37,73,8e,0b,6e,8a,f8,47,ef,4a,74,a9,a4,d9,df,04,8d,5d,6b,f2,19,c7,\
|
|
# ab,f5,40,72,00,c3,5d,3c,dc,d5,e7,e2,c6,51,fe,0d,77,bc,60,41,e1,51,96,46,f5,\
|
|
# 8b,1c,cc,a2,11,1a,37,25,86,6b,be,2b,60,4f,9d,17,2f,28,53,9a,97,5d,1d,0f,99,\
|
|
# 7e,4c,d2,8c,49,7f,ad,62,a7,90,e7,35,2f,19,40,1e,fb,7d,7f,b6,ba,cb,85,e0,67,\
|
|
# 4e,ab,03,1d,78,2f,a0,e7,3d,8e,b4,b4,0a,c6,ee,cc,a8,d9,87,fd,b9,0c,c1,01,54,\
|
|
# a5,39,6a,26,7c,69,cb,47,68,c3,a6,43,59,12,bb,b6,0d,68,91,d2,1b,de,bc,da,0f,\
|
|
# 0a,b5,20,00,00,04,ff,01,00,00
|
|
|
|
use strict;
|
|
use warnings;
|
|
use utf8;
|
|
|
|
|
|
#
|
|
# Constants:
|
|
#
|
|
|
|
my $REGISTRY_PREFIX = "=hex:";
|
|
|
|
my $ENTRY_KEY_USER = 16;
|
|
my $ENTRY_KEY_MODULUS = 48;
|
|
my $ENTRY_KEY_GENERATOR = 64;
|
|
my $ENTRY_KEY_SALT = 80;
|
|
my $ENTRY_KEY_VERIFIER = 96;
|
|
|
|
my $HARD_CODED_GENERATOR = "05";
|
|
my $HARD_CODED_MODULUS = "9847fc7e0f891dfd5d02f19d587d8f77aec0b980d4304b0113b406f23e2cec58cafca04a53e36fb68e0c3bff92cf335786b0dbe60dfe4178ef2fcd2a4dd09947ffd8df96fd0f9e2981a32da95503342eca9f08062cbdd4ac2d7cdf810db4db96db70102266261cd3f8bdd56a102fc6ceedbba5eae99e6127bdd952f7a0d18a79021c881ae63ec4b3590387f548598f2cb8f90dea36fc4f80c5473fdb6b0c6bdb0fdbaf4601f560dd149167ea125db8ad34fd0fd45350dec72cfb3b528ba2332d6091acea89dfd06c9c4d18f697245bd2ac9278b92bfe7dbafaa0c43b40a71f1930ebc4fd24c9e5a2e5a4ccf5d7f51544d70b2bca4af5b8d37b379fd7740a682f";
|
|
|
|
|
|
#
|
|
# Start:
|
|
#
|
|
|
|
if (scalar (@ARGV) < 1)
|
|
{
|
|
print STDERR "Usage:\n" . $0 . " <radmin3.reg>\n\n";
|
|
print STDERR "Please specify the Radmin 3 registry export file as command line parameter\n\n";
|
|
print STDERR "The registry key is something like:\n";
|
|
print STDERR "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Radmin\\v3.0\\Server\\Parameters\\Radmin Security\\1\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
my $file_name = $ARGV[0];
|
|
|
|
my $fh;
|
|
|
|
if (! open ($fh, "<", $file_name))
|
|
{
|
|
print STDERR "ERROR: Could not open the registry dump file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
binmode ($fh);
|
|
|
|
my $file_content = "";
|
|
|
|
{
|
|
local $/ = undef;
|
|
|
|
$file_content = <$fh>;
|
|
}
|
|
|
|
close ($fh);
|
|
|
|
|
|
if (length ($file_content) < 5 + 0) # replace 0 with minimum expected length
|
|
{
|
|
print STDERR "ERROR: File size of file '$file_name' is invalid\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
$file_content =~ s/[\x00]//g; # this could be true if UTF16 + BOM are being used
|
|
|
|
my $prefix_idx = index ($file_content, $REGISTRY_PREFIX);
|
|
|
|
if ($prefix_idx < 0)
|
|
{
|
|
print STDERR "ERROR: Could not find the key '=hex:' within the file content\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
$file_content = substr ($file_content, $prefix_idx + length ($REGISTRY_PREFIX));
|
|
|
|
# $file_content =~ s/[ \r\n,\\]//g;
|
|
|
|
# we could also remove every character that is not an hexadecimal symbol:
|
|
$file_content =~ s/[^0-9a-fA-F]//g;
|
|
|
|
$file_content = pack ("H*", $file_content);
|
|
|
|
|
|
# final length check (needed ?):
|
|
|
|
my $file_content_len = length ($file_content);
|
|
|
|
if ($file_content_len < 2 + 1 + 2 + 1 + 2 + 32 + 2 + 256 + 2 + 256) # replace with min length
|
|
{
|
|
print STDERR "ERROR: File content of file '$file_name' is too short\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
|
|
# loop over the data:
|
|
|
|
my $user = "";
|
|
my $salt = "";
|
|
my $verifier = "";
|
|
|
|
my $found_user = 0;
|
|
my $found_modulus = 0;
|
|
my $found_generator = 0;
|
|
my $found_salt = 0;
|
|
my $found_verifier = 0;
|
|
|
|
for (my $i = 0; $i < $file_content_len; $i += 4)
|
|
{
|
|
if ($i + 4 > $file_content_len)
|
|
{
|
|
print STDERR "ERROR: Unexpected EOF (end of file) in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
my $type = ord (substr ($file_content, $i + 1, 1)) * 256 +
|
|
ord (substr ($file_content, $i + 0, 1));
|
|
my $len = ord (substr ($file_content, $i + 2, 1)) * 256 +
|
|
ord (substr ($file_content, $i + 3, 1));
|
|
|
|
my $pos = $i + 4;
|
|
|
|
$i += $len;
|
|
|
|
# we are not interested in other values than what we need:
|
|
|
|
if (($type != $ENTRY_KEY_USER) &&
|
|
($type != $ENTRY_KEY_MODULUS) &&
|
|
($type != $ENTRY_KEY_GENERATOR) &&
|
|
($type != $ENTRY_KEY_SALT) &&
|
|
($type != $ENTRY_KEY_VERIFIER))
|
|
{
|
|
next;
|
|
}
|
|
|
|
if ($i > $file_content_len)
|
|
{
|
|
print STDERR "ERROR: Unexpected EOF (end of file) in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
|
|
#
|
|
# get the data, finally:
|
|
#
|
|
|
|
my $value = substr ($file_content, $pos, $len);
|
|
|
|
$value = unpack ("H*", $value);
|
|
|
|
if ($type == $ENTRY_KEY_USER)
|
|
{
|
|
$user = $value;
|
|
|
|
$found_user = 1;
|
|
}
|
|
elsif ($type == $ENTRY_KEY_MODULUS)
|
|
{
|
|
if ($value ne $HARD_CODED_MODULUS)
|
|
{
|
|
print STDERR "ERROR: Non-default modulus found in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
$found_modulus = 1;
|
|
}
|
|
elsif ($type == $ENTRY_KEY_GENERATOR)
|
|
{
|
|
if ($value ne $HARD_CODED_GENERATOR)
|
|
{
|
|
print STDERR "ERROR: Non-default generator found in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
$found_generator = 1;
|
|
}
|
|
elsif ($type == $ENTRY_KEY_SALT)
|
|
{
|
|
$salt = $value;
|
|
|
|
$found_salt = 1;
|
|
}
|
|
elsif ($type == $ENTRY_KEY_VERIFIER)
|
|
{
|
|
$verifier = $value;
|
|
|
|
$found_verifier = 1;
|
|
}
|
|
}
|
|
|
|
if ($found_user == 0)
|
|
{
|
|
print STDERR "ERROR: No user name found in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
if ($found_modulus == 0)
|
|
{
|
|
print STDERR "ERROR: No modulus found in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
if ($found_generator == 0)
|
|
{
|
|
print STDERR "ERROR: No generator found in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
if ($found_salt == 0)
|
|
{
|
|
print STDERR "ERROR: No salt found in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
if ($found_verifier == 0)
|
|
{
|
|
print STDERR "ERROR: No verifier found in file '$file_name'\n";
|
|
|
|
exit (1);
|
|
}
|
|
|
|
|
|
#
|
|
# Output:
|
|
#
|
|
|
|
print sprintf ("\$radmin3\$%s*%s*%s\n",
|
|
$user,
|
|
$salt,
|
|
$verifier);
|