mirror of
https://github.com/hashcat/hashcat.git
synced 2025-07-24 15:38:47 +00:00
15ada5124e
Updated kernel declarations from "KERNEL_FQ void HC_ATTR_SEQ" to "KERNEL_FQ KERNEL_FA void". Please update your custom plugin kernels accordingly. Added spilling size as a factor in calculating usable memory per device. This is based on undocumented variables and may not be 100% accurate, but it works well in practice. Added a compiler hint to scrypt-based kernels indicating the guaranteed maximum thread count per kernel invocation. Removed redundant kernel code 29800, as it is identical to 27700, and updated the plugin.
341 lines
7.7 KiB
Common Lisp
341 lines
7.7 KiB
Common Lisp
/**
|
|
* Author......: See docs/credits.txt
|
|
* License.....: MIT
|
|
*/
|
|
|
|
//shared mem too small
|
|
//#define NEW_SIMD_CODE
|
|
|
|
#ifdef KERNEL_STATIC
|
|
#include M2S(INCLUDE_PATH/inc_vendor.h)
|
|
#include M2S(INCLUDE_PATH/inc_types.h)
|
|
#include M2S(INCLUDE_PATH/inc_platform.cl)
|
|
#include M2S(INCLUDE_PATH/inc_common.cl)
|
|
#include M2S(INCLUDE_PATH/inc_hash_md4.cl)
|
|
#include M2S(INCLUDE_PATH/inc_hash_md5.cl)
|
|
#include M2S(INCLUDE_PATH/inc_cipher_rc4.cl)
|
|
#endif
|
|
|
|
typedef struct krb5pa
|
|
{
|
|
u32 user[16];
|
|
u32 realm[16];
|
|
u32 salt[32];
|
|
u32 timestamp[16];
|
|
u32 checksum[4];
|
|
|
|
} krb5pa_t;
|
|
|
|
DECLSPEC int decrypt_and_check (LOCAL_AS u32 *S, PRIVATE_AS u32 *data, PRIVATE_AS u32 *timestamp_ct, const u64 lid)
|
|
{
|
|
rc4_init_128 (S, data, lid);
|
|
|
|
u32 out[4];
|
|
|
|
u8 j = 0;
|
|
|
|
j = rc4_next_16 (S, 0, j, timestamp_ct + 0, out, lid);
|
|
|
|
if ((out[3] & 0xffff0000) != 0x30320000) return 0;
|
|
|
|
j = rc4_next_16 (S, 16, j, timestamp_ct + 4, out, lid);
|
|
|
|
if (((out[0] & 0xff) < '0') || ((out[0] & 0xff) > '9')) return 0; out[0] >>= 8;
|
|
if (((out[0] & 0xff) < '0') || ((out[0] & 0xff) > '9')) return 0; out[0] >>= 8;
|
|
if (((out[0] & 0xff) < '0') || ((out[0] & 0xff) > '9')) return 0; out[0] >>= 8;
|
|
if (((out[0] & 0xff) < '0') || ((out[0] & 0xff) > '9')) return 0;
|
|
if (((out[1] & 0xff) < '0') || ((out[1] & 0xff) > '9')) return 0; out[1] >>= 8;
|
|
if (((out[1] & 0xff) < '0') || ((out[1] & 0xff) > '9')) return 0; out[1] >>= 8;
|
|
if (((out[1] & 0xff) < '0') || ((out[1] & 0xff) > '9')) return 0; out[1] >>= 8;
|
|
if (((out[1] & 0xff) < '0') || ((out[1] & 0xff) > '9')) return 0;
|
|
if (((out[2] & 0xff) < '0') || ((out[2] & 0xff) > '9')) return 0; out[2] >>= 8;
|
|
if (((out[2] & 0xff) < '0') || ((out[2] & 0xff) > '9')) return 0; out[2] >>= 8;
|
|
if (((out[2] & 0xff) < '0') || ((out[2] & 0xff) > '9')) return 0; out[2] >>= 8;
|
|
if (((out[2] & 0xff) < '0') || ((out[2] & 0xff) > '9')) return 0;
|
|
|
|
return 1;
|
|
}
|
|
|
|
DECLSPEC void kerb_prepare (PRIVATE_AS const u32 *K, PRIVATE_AS const u32 *checksum, PRIVATE_AS u32 *digest)
|
|
{
|
|
// K1=MD5_HMAC(K,1); with 1 encoded as little indian on 4 bytes (01000000 in hexa);
|
|
|
|
u32 w0[4];
|
|
u32 w1[4];
|
|
u32 w2[4];
|
|
u32 w3[4];
|
|
|
|
w0[0] = K[0];
|
|
w0[1] = K[1];
|
|
w0[2] = K[2];
|
|
w0[3] = K[3];
|
|
w1[0] = 0;
|
|
w1[1] = 0;
|
|
w1[2] = 0;
|
|
w1[3] = 0;
|
|
w2[0] = 0;
|
|
w2[1] = 0;
|
|
w2[2] = 0;
|
|
w2[3] = 0;
|
|
w3[0] = 0;
|
|
w3[1] = 0;
|
|
w3[2] = 0;
|
|
w3[3] = 0;
|
|
|
|
md5_hmac_ctx_t ctx1;
|
|
|
|
md5_hmac_init_64 (&ctx1, w0, w1, w2, w3);
|
|
|
|
w0[0] = 1;
|
|
w0[1] = 0;
|
|
w0[2] = 0;
|
|
w0[3] = 0;
|
|
w1[0] = 0;
|
|
w1[1] = 0;
|
|
w1[2] = 0;
|
|
w1[3] = 0;
|
|
w2[0] = 0;
|
|
w2[1] = 0;
|
|
w2[2] = 0;
|
|
w2[3] = 0;
|
|
w3[0] = 0;
|
|
w3[1] = 0;
|
|
w3[2] = 0;
|
|
w3[3] = 0;
|
|
|
|
md5_hmac_update_64 (&ctx1, w0, w1, w2, w3, 4);
|
|
|
|
md5_hmac_final (&ctx1);
|
|
|
|
w0[0] = ctx1.opad.h[0];
|
|
w0[1] = ctx1.opad.h[1];
|
|
w0[2] = ctx1.opad.h[2];
|
|
w0[3] = ctx1.opad.h[3];
|
|
w1[0] = 0;
|
|
w1[1] = 0;
|
|
w1[2] = 0;
|
|
w1[3] = 0;
|
|
w2[0] = 0;
|
|
w2[1] = 0;
|
|
w2[2] = 0;
|
|
w2[3] = 0;
|
|
w3[0] = 0;
|
|
w3[1] = 0;
|
|
w3[2] = 0;
|
|
w3[3] = 0;
|
|
|
|
md5_hmac_ctx_t ctx;
|
|
|
|
md5_hmac_init_64 (&ctx, w0, w1, w2, w3);
|
|
|
|
w0[0] = checksum[0];
|
|
w0[1] = checksum[1];
|
|
w0[2] = checksum[2];
|
|
w0[3] = checksum[3];
|
|
w1[0] = 0;
|
|
w1[1] = 0;
|
|
w1[2] = 0;
|
|
w1[3] = 0;
|
|
w2[0] = 0;
|
|
w2[1] = 0;
|
|
w2[2] = 0;
|
|
w2[3] = 0;
|
|
w3[0] = 0;
|
|
w3[1] = 0;
|
|
w3[2] = 0;
|
|
w3[3] = 0;
|
|
|
|
md5_hmac_update_64 (&ctx, w0, w1, w2, w3, 16);
|
|
|
|
md5_hmac_final (&ctx);
|
|
|
|
digest[0] = ctx.opad.h[0];
|
|
digest[1] = ctx.opad.h[1];
|
|
digest[2] = ctx.opad.h[2];
|
|
digest[3] = ctx.opad.h[3];
|
|
}
|
|
|
|
KERNEL_FQ KERNEL_FA void m07500_mxx (KERN_ATTR_VECTOR_ESALT (krb5pa_t))
|
|
{
|
|
/**
|
|
* modifier
|
|
*/
|
|
|
|
const u64 lid = get_local_id (0);
|
|
const u64 gid = get_global_id (0);
|
|
|
|
if (gid >= GID_CNT) return;
|
|
|
|
/**
|
|
* digest
|
|
*/
|
|
|
|
const u32 search[4] =
|
|
{
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R0],
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R1],
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R2],
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R3]
|
|
};
|
|
|
|
/**
|
|
* base
|
|
*/
|
|
|
|
const u32 pw_len = pws[gid].pw_len;
|
|
|
|
u32x w[64] = { 0 };
|
|
|
|
for (u32 i = 0, idx = 0; i < pw_len; i += 4, idx += 1)
|
|
{
|
|
w[idx] = pws[gid].i[idx];
|
|
}
|
|
|
|
LOCAL_VK u32 S[64 * FIXED_LOCAL_SIZE];
|
|
|
|
u32 checksum[4];
|
|
|
|
checksum[0] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[0];
|
|
checksum[1] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[1];
|
|
checksum[2] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[2];
|
|
checksum[3] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[3];
|
|
|
|
u32 timestamp_ct[8];
|
|
|
|
timestamp_ct[0] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[0];
|
|
timestamp_ct[1] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[1];
|
|
timestamp_ct[2] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[2];
|
|
timestamp_ct[3] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[3];
|
|
timestamp_ct[4] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[4];
|
|
timestamp_ct[5] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[5];
|
|
timestamp_ct[6] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[6];
|
|
timestamp_ct[7] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[7];
|
|
|
|
/**
|
|
* loop
|
|
*/
|
|
|
|
u32x w0l = w[0];
|
|
|
|
for (u32 il_pos = 0; il_pos < IL_CNT; il_pos += VECT_SIZE)
|
|
{
|
|
const u32x w0r = words_buf_r[il_pos / VECT_SIZE];
|
|
|
|
const u32x w0 = w0l | w0r;
|
|
|
|
w[0] = w0;
|
|
|
|
md4_ctx_t ctx;
|
|
|
|
md4_init (&ctx);
|
|
|
|
md4_update_utf16le (&ctx, w, pw_len);
|
|
|
|
md4_final (&ctx);
|
|
|
|
u32 digest[4];
|
|
|
|
kerb_prepare (ctx.h, checksum, digest);
|
|
|
|
if (decrypt_and_check (S, digest, timestamp_ct, lid) == 1)
|
|
{
|
|
if (hc_atomic_inc (&hashes_shown[DIGESTS_OFFSET_HOST]) == 0)
|
|
{
|
|
mark_hash (plains_buf, d_return_buf, SALT_POS_HOST, DIGESTS_CNT, 0, DIGESTS_OFFSET_HOST + 0, gid, il_pos, 0, 0);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
KERNEL_FQ KERNEL_FA void m07500_sxx (KERN_ATTR_VECTOR_ESALT (krb5pa_t))
|
|
{
|
|
/**
|
|
* modifier
|
|
*/
|
|
|
|
const u64 lid = get_local_id (0);
|
|
const u64 gid = get_global_id (0);
|
|
|
|
if (gid >= GID_CNT) return;
|
|
|
|
/**
|
|
* digest
|
|
*/
|
|
|
|
const u32 search[4] =
|
|
{
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R0],
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R1],
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R2],
|
|
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R3]
|
|
};
|
|
|
|
/**
|
|
* base
|
|
*/
|
|
|
|
const u32 pw_len = pws[gid].pw_len;
|
|
|
|
u32x w[64] = { 0 };
|
|
|
|
for (u32 i = 0, idx = 0; i < pw_len; i += 4, idx += 1)
|
|
{
|
|
w[idx] = pws[gid].i[idx];
|
|
}
|
|
|
|
LOCAL_VK u32 S[64 * FIXED_LOCAL_SIZE];
|
|
|
|
u32 checksum[4];
|
|
|
|
checksum[0] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[0];
|
|
checksum[1] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[1];
|
|
checksum[2] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[2];
|
|
checksum[3] = esalt_bufs[DIGESTS_OFFSET_HOST].checksum[3];
|
|
|
|
u32 timestamp_ct[8];
|
|
|
|
timestamp_ct[0] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[0];
|
|
timestamp_ct[1] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[1];
|
|
timestamp_ct[2] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[2];
|
|
timestamp_ct[3] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[3];
|
|
timestamp_ct[4] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[4];
|
|
timestamp_ct[5] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[5];
|
|
timestamp_ct[6] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[6];
|
|
timestamp_ct[7] = esalt_bufs[DIGESTS_OFFSET_HOST].timestamp[7];
|
|
|
|
/**
|
|
* loop
|
|
*/
|
|
|
|
u32x w0l = w[0];
|
|
|
|
for (u32 il_pos = 0; il_pos < IL_CNT; il_pos += VECT_SIZE)
|
|
{
|
|
const u32x w0r = words_buf_r[il_pos / VECT_SIZE];
|
|
|
|
const u32x w0 = w0l | w0r;
|
|
|
|
w[0] = w0;
|
|
|
|
md4_ctx_t ctx;
|
|
|
|
md4_init (&ctx);
|
|
|
|
md4_update_utf16le (&ctx, w, pw_len);
|
|
|
|
md4_final (&ctx);
|
|
|
|
u32 digest[4];
|
|
|
|
kerb_prepare (ctx.h, checksum, digest);
|
|
|
|
if (decrypt_and_check (S, digest, timestamp_ct, lid) == 1)
|
|
{
|
|
if (hc_atomic_inc (&hashes_shown[DIGESTS_OFFSET_HOST]) == 0)
|
|
{
|
|
mark_hash (plains_buf, d_return_buf, SALT_POS_HOST, DIGESTS_CNT, 0, DIGESTS_OFFSET_HOST + 0, gid, il_pos, 0, 0);
|
|
}
|
|
}
|
|
}
|
|
}
|