From 67a36b7a4b535bb725231d7078227c1f353e4ec4 Mon Sep 17 00:00:00 2001 From: h00die Date: Sat, 17 Jan 2026 13:21:42 -0500 Subject: [PATCH 1/8] kerberoast hash types added for cracking --- .../Hashes-and-Password-Cracking.md | 196 ++++++++++-------- .../framework/password_crackers/cracker.rb | 16 +- .../framework/hashes/identify_spec.rb | 28 +++ 3 files changed, 146 insertions(+), 94 deletions(-) diff --git a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md index 75543255981d9..219f546fe9398 100644 --- a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md +++ b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md @@ -10,11 +10,11 @@ Many modules dump hashes from various software. Anything from the OS: [Windows] In this first, simple, example we will simply show loading the library and calling its function. ```ruby -require 'metasploit/framework/hashes/identify' -puts identify_hash "$1$28772684$iEwNOgGugqO9.bIz5sk8k/" +require 'metasploit/framework/hashes' +puts Metasploit::Framework::Hashes.identify_hash("$1$28772684$iEwNOgGugqO9.bIz5sk8k/") # note, bad hashes return an empty string since nil is not accepted when creating credentials in msf. -puts identify_hash "This_is a Fake Hash" -puts identify_hash "_9G..8147mpcfKT8g0U." +puts Metasploit::Framework::Hashes.identify_hash("This_is a Fake Hash") +puts Metasploit::Framework::Hashes.identify_hash("_9G..8147mpcfKT8g0U.") ``` In practice, we receive the following output from this: ```ruby @@ -23,15 +23,15 @@ msf > irb [*] You are in the "framework" object irb: warn: can't alias jobs from irb_jobs. ->> require 'metasploit/framework/hashes/identify' +>> require 'metasploit/framework/hashes' => false ->> puts identify_hash "$1$28772684$iEwNOgGugqO9.bIz5sk8k/" +>> puts Metasploit::Framework::Hashes.identify_hash("$1$28772684$iEwNOgGugqO9.bIz5sk8k/") md5 => nil ->> puts identify_hash "This_is a Fake Hash" +>> puts Metasploit::Framework::Hashes.identify_hash("This_is a Fake Hash") => nil ->> puts identify_hash "_9G..8147mpcfKT8g0U." +>> puts Metasploit::Framework::Hashes.identify_hash("_9G..8147mpcfKT8g0U.") des,bsdi,crypt ``` @@ -42,58 +42,63 @@ This section will cover the differences between the two crackers. This is not a ### General Settings -| Description | JtR | hashcat | +| Description | JtR | hashcat | --------------- | ---------------- | ------------------- | -| session | `--session` | `--session` | +| session | `--session` | `--session` | no logging | `--no-log` | `--logfile-disable` | -| config file | `--config` | (n/a) | -| previous cracks | `--pot` | `--potfile-path` | -| type of hashes | `--format` | `--hash-type` | -| wordlist | `--wordlist` | (last parameter) | -| incremental | `--incremental` | `--increment` | -| rules | `--rules` | `--rules-file` | -| max run time | `--max-run-time` | `--runtime` | -| show results | `--show` | `--show` | +| config file | `--config` | (n/a) +| previous cracks | `--pot` | `--potfile-path` +| type of hashes | `--format` | `--hash-type` +| wordlist | `--wordlist` | (last parameter) +| incremental | `--incremental` | `--increment` +| rules | `--rules` | `--rules-file` +| max run time | `--max-run-time` | `--runtime` +| show results | `--show` | `--show` ### Hash Setting | Hash | JtR | [hashcat](https://hashcat.net/wiki/doku.php?id=example_hashes) | | --------------------------- | ------------------------------------------------------ | -------------------------------------------------------------- | -| List formats | `john --list=formats` `john --list=format-all-details` | `hashcat -h` | -| | | | -| cram-md5 | hmac-md5 | 10200 | -| des | descrypt | 1500 | -| md5 (crypt is $1$) | md5crypt | 500 | -| sha1 | | 100 | -| bsdi | bsdicrypt | 12400 | -| sha256 | sha256crypt | 7400 | -| sha512 | sha512crypt | 1800 | -| blowfish | bcrypt | 3200 | -| lanman | lm | 3000 | -| NTLM | nt | 1000 | -| mssql (05) | mssql | 131 | -| mssql12 | mssql12 | 1731 | -| mssql (2012/2014) | mssql05 | 132 | -| oracle (10) | oracle | 3100 | -| oracle 11 | oracle11 | 112 | -| oracle 12 | oracle12c | 12300 | -| postgres | dynamic_1034 | 12 | -| mysql | mysql | 200 | -| mysql-sha1 | mysql-sha1 | 300 | -| sha512($p.$s) - vmware ldap | dynamic_82 | 1710 | -| md5 (raw, unicode) | Raw-MD5u | 30 (with an empty salt) | -| NetNTLMv1 | netntlm | 5500 | -| NetNTLMv2 | netntlmv2 | 5600 | -| pbkdf2-sha256 | PBKDF2-HMAC-SHA256 | 10900 | -| Android (Samsung) SHA1 | | 5800 | -| Android (non-Samsung) SHA1 | | 110 | -| Android MD5 | | 10 | -| xsha | xsha | 122 | -| xsha512 | xsha512 | 1722 | -| PBKDF2-HMAC-SHA512 | PBKDF2-HMAC-SHA512 | 7100 | -| PBKDF2-HMAC-SHA1 | PBKDF2-HMAC-SHA1 | 12001 | -| PHPass | phpass | 400 | -| mediawiki | mediawiki | 3711 | +| List formats | `john --list=formats` `john --list=format-all-details` | `hashcat -h` +| | | +| cram-md5 | hmac-md5 | 10200 +| des | descrypt | 1500 +| md5 (crypt is $1$) | md5crypt | 500 +| sha1 | | 100 +| bsdi | bsdicrypt | 12400 +| sha256 | sha256crypt | 7400 +| sha512 | sha512crypt | 1800 +| blowfish | bcrypt | 3200 +| lanman | lm | 3000 +| NTLM | nt | 1000 +| krb5tgs-rc4 | krb5tgs | 13100 +| krb5tgs-aes128 | | 19600 +| krb5tgs-aes256 | | 19700 +| krb5asrep-rc4 | | 18200 +| timeroast | | 31300 +| mssql (05) | mssql | 131 +| mssql12 | mssql12 | 1731 +| mssql (2012/2014) | mssql05 | 132 +| oracle (10) | oracle | 3100 +| oracle 11 | oracle11 | 112 +| oracle 12 | oracle12c | 12300 +| postgres | dynamic_1034 | 12 +| mysql | mysql | 200 +| mysql-sha1 | mysql-sha1 | 300 +| sha512($p.$s) - vmware ldap | dynamic_82 | 1710 +| md5 (raw, unicode) | Raw-MD5u | 30 (with an empty salt) +| NetNTLMv1 | netntlm | 5500 +| NetNTLMv2 | netntlmv2 | 5600 +| pbkdf2-sha256 | PBKDF2-HMAC-SHA256 | 10900 +| Android (Samsung) SHA1 | | 5800 +| Android (non-Samsung) SHA1 | | 110 +| Android MD5 | | 10 +| xsha | xsha | 122 +| xsha512 | xsha512 | 1722 +| PBKDF2-HMAC-SHA512 | PBKDF2-HMAC-SHA512 | 7100 +| PBKDF2-HMAC-SHA1 | PBKDF2-HMAC-SHA1 | 12001 +| PHPass | phpass | 400 +| mediawiki | mediawiki | 3711 While Metasploit standardizes with the JtR format, the hashcat [library](https://github.com/rapid7/metasploit-framework/blob/master/lib/metasploit/framework/password_crackers/cracker.rb) includes the `jtr_format_to_hashcat_format` function to translate from jtr to hashcat. @@ -147,6 +152,11 @@ creds add user:u4-netntlm hash:u4-netntlm::kNS:338d08f8e26de93300000000000000000 creds add user:admin hash:admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030 jtr:netntlmv2 creds add user:mscash-test1 hash:M$test1#64cd29e36a8431a2b111378564a10631 jtr:mscash creds add user:mscash2-hashcat hash:$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2 +creds add user:krb5tgs-rc4 hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4 +creds add user:krb5tgs-aes128 hash:$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128 +creds add user:krb5tgs-aes256 hash:$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256 +creds add user:krb5asrep-rc4 hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4 +creds add user:timeroast hash: jtr:timeroast # sql creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05 creds add user:mssql_foo hash:0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254 jtr:mssql @@ -184,44 +194,48 @@ creds add user:admin hash:'$pbkdf2-sha256$260000$Q1hzYjU5dFNMWm05QUJCTg$s.vmjGlI This data breaks down to the following table: -| Hash Type | Username | Hash | Password | jtr format | Modules which dump this info | Modules which crack this | -| ------------------------------------ | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | -------------------- | ------------------------------------------------ | --------------------------------------------------------- | -| ----------- | ---------- | ------ | ---------- | ------------ | ------------------------------ | ------------------------- | -| DES | des_password | `rEK1ecacw.7.c` | password | des | post/aix/gather/hashdump | auxiliary/analyze/crack_aix auxiliary/analyze/crack_linux | -| MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| SHA256 | sha256_password | `$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5` | password | sha256,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| SHA512 | sha512_password | `$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1` | password | sha512,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| Blowfish | blowfish_password | `$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe` | password | bf | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| Lanman | lm_password | `E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C` | password | lm | post/windows/gather/hashdump | auxiliary/analyze/crack_windows | -| NTLM | nt_password | `AAD3B435B51404EEAAD3B435B51404EE:8846F7EAEE8FB117AD06BDD830B7586C` | password | nt | post/linux/gather/hashdump | auxiliary/analyze/crack_windows | -| NetNTLMv1 | u4-netntlm | `u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c` | hashcat | netntlm | | auxiliary/analyze/crack_windows | -| NetNTLMv2 | admin | `admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030` | hashcat | netntlmv2 | | auxiliary/analyze/crack_windows | -| MSCash | mscash-test1 | `M$test1#64cd29e36a8431a2b111378564a10631` | test1 | mscash | | auxiliary/analyze/crack_windows | -| MSCash2 | mscash2-hashcat | `$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f` | hashcat | mscash2 | | auxiliary/analyze/crack_windows | -| MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | -| MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | -| MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password1! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | -| MySQL | mysql_probe | `445ff82636a7ba59` | probe | mysql | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | -| MySQL SHA1 | mysql-sha1_tere | `*5AD8F88516BD021DD43F171E2C785C69F8E54ADB` | tere | mysql-sha1 | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | -| Oracle | simon | `4F8BC1809CB2AF77` | A | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle | SYSTEM | `9EEDFA0AD26C6D52` | THALES | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle 11 | DEMO | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle 11 | oracle11_epsilon | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | modules/auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle 12 | oracle12_epsilon | `H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B` | epsilon | pbkdf2,oracle12c | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Postgres | example | `md5be86a79bf2043622d58d5453c47d4860` | password | raw-md5,postgres | auxiliary/scanner/postgres/postgres_hashdump | auxiliary/analyze/crack_databases | -| Android (Samsung) SHA1 | samsungsha1 | `D1B19A90B87FC10C304E657F37162445DAE27D16:a006983800cc3dd1` | 1234 | android-samsung-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | -| Android (non-Samsung) SHA1 | androidsha1 | `9860A48CA459D054F3FEF0F8518CF6872923DAE2:81fcb23bcadd6c5` | 1234 | android-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | -| Android MD5 | androidmd5 | `1C0A0FDB673FBA36BEAEB078322C7393:81fcb23bcadd6c5` | 1234 | android-md5 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | -| OSX 10.4-10.6 | xsha_hashcat | `1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683` | hashcat | xsha | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | -| OSX 10.8+ | pbkdf2_hashcat | `$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f9$` | hashcat | PBKDF2-HMAC-SHA512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | -| OSX 10.7 | xsha512_hashcat | `648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d` | hashcat | xsha512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | -| HMAC-MD5 | hmac_password | `<3263520797@127.0.0.1>#3f089332842764e71f8400ede97a84c9` | password | hmac-md5 | auxiliary/server/capture/smtp | | -| SHA512($p.$s)/dynamic_82/vmware ldap | vmware_ldap | `$dynamic_82$a702505b8a67b45065a6a7ff81ec6685f08d06568e478e1a7695484a934b19a28b94f58595d4de68b27771362bc2b52444a0ed03e980e11ad5e5ffa6daa9e7e1$HEX$171ada255464a439569352c60258e7c6` | TestPass123# | dynamic_82 | | | -| MediaWiki | mediawiki_hashcat | `$B$56668501$0ce106caa70af57fd525aeaf80ef2898` | hashcat | mediawiki | | modules/auxiliary/analyze/crack_webapps | -| PHPPass (P type) | phpass_p_hashcat | `$P$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass | | modules/auxiliary/analyze/crack_webapps | -| PHPPass (H type) | phpass_h_hashcat | `$H$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass | | modules/auxiliary/analyze/crack_webapps | -| Atlassian | atlassian_hashcat | `{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa` | hashcat | PBKDF2-HMAC-SHA1 | | modules/auxiliary/analyze/crack_webapps | +| **Hash Type** | **Username** | **Hash** | **Password** | **jtr format** | **Modules which dump this info** | **Modules which crack this** | +|:------------------------------------:|:------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------:|:--------------------:|:------------------------------------------------:|:---------------------------------------------------------:| +| DES | des_password | `rEK1ecacw.7.c` | password | des | post/aix/gather/hashdump | auxiliary/analyze/crack_aix auxiliary/analyze/crack_linux | +| MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| SHA256 | sha256_password | `$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5` | password | sha256,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| SHA512 | sha512_password | `$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1` | password | sha512,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| Blowfish | blowfish_password | `$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe` | password | bf | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| Lanman | lm_password | `E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C` | password | lm | post/windows/gather/hashdump | auxiliary/analyze/crack_windows | +| NTLM | nt_password | `AAD3B435B51404EEAAD3B435B51404EE:8846F7EAEE8FB117AD06BDD830B7586C` | password | nt | post/linux/gather/hashdump | auxiliary/analyze/crack_windows | +| NetNTLMv1 | u4-netntlm | `u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c` | hashcat | netntlm |   | auxiliary/analyze/crack_windows | +| NetNTLMv2 | admin | `admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030` | hashcat | netntlmv2 |   | auxiliary/analyze/crack_windows | +| MSCash | mscash-test1 | `M$test1#64cd29e36a8431a2b111378564a10631` | test1 | mscash |   | auxiliary/analyze/crack_windows | +| MSCash2 | mscash2-hashcat | `$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f` | hashcat | mscash2 |   | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs-rc4 | `$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab` | Password1! | krb5tgs-rc4 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| | krb5tgs-aes128 | `$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e` | hashcat | krb5tgs-aes128 | | auxiliary/analyze/crack_windows | +| | krb5tgs-aes256 | `$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0` | hashcat | krb5tgs-aes256 | | auxiliary/analyze/crack_windows | +| | krb5asrep-rc4 | `$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac` | hashcat | krb5asrep-rc4 | | auxiliary/analyze/crack_windows | +| | timeroast | | | timeroast | | auxiliary/analyze/crack_windows | +| MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | +| MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | +| MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password1! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | +| MySQL | mysql_probe | `445ff82636a7ba59` | probe | mysql | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | +| MySQL SHA1 | mysql-sha1_tere | `*5AD8F88516BD021DD43F171E2C785C69F8E54ADB` | tere | mysql-sha1 | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | +| Oracle | simon | `4F8BC1809CB2AF77` | A | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle | SYSTEM | `9EEDFA0AD26C6D52` | THALES | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle 11 | DEMO | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle 11 | oracle11_epsilon | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | modules/auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle 12 | oracle12_epsilon | `H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B` | epsilon | pbkdf2,oracle12c | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Postgres | example | `md5be86a79bf2043622d58d5453c47d4860` | password | raw-md5,postgres | auxiliary/scanner/postgres/postgres_hashdump | auxiliary/analyze/crack_databases | +| Android (Samsung) SHA1 | samsungsha1 | `D1B19A90B87FC10C304E657F37162445DAE27D16:a006983800cc3dd1` | 1234 | android-samsung-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | +| Android (non-Samsung) SHA1 | androidsha1 | `9860A48CA459D054F3FEF0F8518CF6872923DAE2:81fcb23bcadd6c5` | 1234 | android-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | +| Android MD5 | androidmd5 | `1C0A0FDB673FBA36BEAEB078322C7393:81fcb23bcadd6c5` | 1234 | android-md5 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | +| OSX 10.4-10.6 | xsha_hashcat | `1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683` | hashcat | xsha | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | +| OSX 10.8+ | pbkdf2_hashcat | `$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f9$` | hashcat | PBKDF2-HMAC-SHA512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | +| OSX 10.7 | xsha512_hashcat | `648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d` | hashcat | xsha512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | +| HMAC-MD5 | hmac_password | `<3263520797@127.0.0.1>#3f089332842764e71f8400ede97a84c9` | password | hmac-md5 | auxiliary/server/capture/smtp |   | +| SHA512($p.$s)/dynamic_82/vmware ldap | vmware_ldap | `$dynamic_82$a702505b8a67b45065a6a7ff81ec6685f08d06568e478e1a7695484a934b19a28b94f58595d4de68b27771362bc2b52444a0ed03e980e11ad5e5ffa6daa9e7e1$HEX$171ada255464a439569352c60258e7c6` | TestPass123# | dynamic_82 |   |   | +| MediaWiki | mediawiki_hashcat | `$B$56668501$0ce106caa70af57fd525aeaf80ef2898` | hashcat | mediawiki |   | modules/auxiliary/analyze/crack_webapps | +| PHPPass (P type) | phpass_p_hashcat | `$P$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass |   | modules/auxiliary/analyze/crack_webapps | +| PHPPass (H type) | phpass_h_hashcat | `$H$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass |   | modules/auxiliary/analyze/crack_webapps | +| Atlassian | atlassian_hashcat | `{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa` | hashcat | PBKDF2-HMAC-SHA1 |   | modules/auxiliary/analyze/crack_webapps | # Adding a New Hash diff --git a/lib/metasploit/framework/password_crackers/cracker.rb b/lib/metasploit/framework/password_crackers/cracker.rb index 318db65e2decb..bd9c60cf21f77 100644 --- a/lib/metasploit/framework/password_crackers/cracker.rb +++ b/lib/metasploit/framework/password_crackers/cracker.rb @@ -119,9 +119,9 @@ def initialize(attributes = {}) public_send("#{attribute}=", value) end end - + def get_type - self.cracker + cracker end # This method takes a {framework.db.cred.private.jtr_format} (string), and @@ -157,6 +157,16 @@ def jtr_format_to_hashcat_format(format) '5500' when 'netntlmv2' '5600' + when 'krb5tgs-rc4' + '13100' + when 'krb5tgs-aes128' + '19600' + when 'krb5tgs-aes256' + '19700' + when 'krb5asrep-rc4' + '18200' + when 'timeroast' + '31300' # dbs when 'mssql' '131' @@ -576,7 +586,7 @@ def show_command end cmd << hash_path end - + def get_hashcat # Look in the Environment PATH for the hashcat binary self.cracker = 'hashcat' diff --git a/spec/lib/metasploit/framework/hashes/identify_spec.rb b/spec/lib/metasploit/framework/hashes/identify_spec.rb index d2dd49d13bcb0..448650f24c9d0 100644 --- a/spec/lib/metasploit/framework/hashes/identify_spec.rb +++ b/spec/lib/metasploit/framework/hashes/identify_spec.rb @@ -299,6 +299,34 @@ end end + describe 'identify_krb5tgs-rc4' do + it 'returns krb5tgs-rc4' do + hash = described_class.identify_hash('$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab') + expect(hash).to match('krb5tgs-rc4') + end + end + + describe 'identify_krb5tgs-aes128' do + it 'returns krb5tgs-aes128' do + hash = described_class.identify_hash('$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e') + expect(hash).to match('krb5tgs-aes128') + end + end + + describe 'identify_krb5tgs-aes256' do + it 'returns krb5tgs-aes256' do + hash = described_class.identify_hash('$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0') + expect(hash).to match('krb5tgs-aes256') + end + end + + describe 'identify_krb5asrep-rc4' do + it 'returns krb5asrep-rc4' do + hash = described_class.identify_hash('$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac') + expect(hash).to match('krb5asrep-rc4') + end + end + describe 'identify_vnc' do it 'returns vnc' do hash = described_class.identify_hash('*00112233445566778899aabbccddeeff*6feb3cb1f07b66151656b5832341f223') From e14f69b00a8a7ea04dfc750308bcd11db079957d Mon Sep 17 00:00:00 2001 From: h00die Date: Sat, 17 Jan 2026 20:05:50 -0500 Subject: [PATCH 2/8] kerberoast hash types added for cracking --- .../Hashes-and-Password-Cracking.md | 3 ++- .../framework/password_crackers/hashcat/formatter.rb | 8 +++++--- modules/auxiliary/analyze/crack_windows.rb | 11 ++++++++++- spec/lib/metasploit/framework/hashes/identify_spec.rb | 7 +++++++ 4 files changed, 24 insertions(+), 5 deletions(-) diff --git a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md index 219f546fe9398..50d0d1c928a3a 100644 --- a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md +++ b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md @@ -156,7 +156,7 @@ creds add user:krb5tgs-rc4 hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql0 creds add user:krb5tgs-aes128 hash:$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128 creds add user:krb5tgs-aes256 hash:$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256 creds add user:krb5asrep-rc4 hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4 -creds add user:timeroast hash: jtr:timeroast +creds add user:timeroast hash:$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast # sql creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05 creds add user:mssql_foo hash:0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254 jtr:mssql @@ -250,3 +250,4 @@ Only hashes which were found in Metasploit were added to the hash id library, an 1. Update this Wiki 1. Add the JTR to hashcat conversion 1. Add example hash(es) +1. Update [tools/dev/hash_cracker_validator.rb](https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/hash_cracker_validator.rb) to help validate hashes can crack diff --git a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb index 3a08fcf06eb27..ed21733846862 100644 --- a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb +++ b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb @@ -131,10 +131,12 @@ def add_equals_to_base64(str) # https://hashcat.net/forum/thread-8833.html # while we can do the transformation, we'd have to throw extra flags at hashcat which aren't currently written into the lib for automation nil - when /^krb5$/ - return "#{cred.id}:#{cred.private.data}" + # when /^krb5$/ + # return "#{cred.id}:#{cred.private.data}" when /^(krb5.|timeroast$)/ - return cred.private.data + # krb5tgs-rc4, krb5tgs-aes128, krb5tgs-aes256, krb5asrep-rc4, timeroast + ## hash-mode: 13100 19600 19700 18200 31300 + return "#{cred.id}:#{cred.private.data}" end end nil diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index f2afa44d540ec..39b19ee6c7f68 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -20,6 +20,7 @@ def initialize MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 is format 5600 in hashcat. + krb5tgs (Kerberos Tickets) is format 13100 in hashcat. ), 'Author' => [ 'theLightCosine', @@ -47,6 +48,7 @@ def initialize OptBool.new('MSCASH', [false, 'Crack M$ CASH hashes (1 and 2)', true]), OptBool.new('NETNTLM', [false, 'Crack NetNTLM', true]), OptBool.new('NETNTLMV2', [false, 'Crack NetNTLMv2', true]), + OptBool.new('KERBEROS', [false, 'Crack krb5 related hashes', true]), OptBool.new('INCREMENTAL', [false, 'Run in incremental mode', true]), OptBool.new('WORDLIST', [false, 'Run in wordlist mode', true]), OptBool.new('NORMAL', [false, 'Run in normal mode (John the Ripper only)', true]) @@ -110,7 +112,7 @@ def check_results(passwords, results, hash_type, method) cred['username'] = fields.shift cred['core_id'] = fields.pop case hash_type - when 'mscash', 'mscash2', 'netntlm', 'netntlmv2' + when 'mscash', 'mscash2', 'netntlm', 'netntlmv2', 'krb5tgs' cred['password'] = fields.shift when 'lm', 'nt' # If we don't have an expected minimum number of fields, this is probably not a NTLM hash @@ -145,6 +147,8 @@ def check_results(passwords, results, hash_type, method) if ['netntlm', 'netntlmv2'].include? hash_type # we could grab the username here, but no need since we grab it later based on core_id, which is safer 6.times { fields.shift } # Get rid of a bunch of extra fields + elsif ['krb5tgs-rc4', 'krb5asrep-rc4'].include? hash_type + 2.times { fields.shift } # Get rid of extra hash fields else cred['hash'] = fields.shift end @@ -179,6 +183,11 @@ def run hash_types_to_crack << 'mscash2' if datastore['MSCASH'] hash_types_to_crack << 'netntlm' if datastore['NETNTLM'] hash_types_to_crack << 'netntlmv2' if datastore['NETNTLMV2'] + hash_types_to_crack << 'krb5tgs-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5tgs-aes128' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5tgs-aes256' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5asrep-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'timeroast' if datastore['KERBEROS'] jobs_to_do = [] diff --git a/spec/lib/metasploit/framework/hashes/identify_spec.rb b/spec/lib/metasploit/framework/hashes/identify_spec.rb index 448650f24c9d0..0c610926ed036 100644 --- a/spec/lib/metasploit/framework/hashes/identify_spec.rb +++ b/spec/lib/metasploit/framework/hashes/identify_spec.rb @@ -327,6 +327,13 @@ end end + describe 'identify_timeroast' do + it 'returns timeroast' do + hash = described_class.identify_hash('$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380') + expect(hash).to match('timeroast') + end + end + describe 'identify_vnc' do it 'returns vnc' do hash = described_class.identify_hash('*00112233445566778899aabbccddeeff*6feb3cb1f07b66151656b5832341f223') From db045c558c9a006ba80e1fe3740d7feb20ffb24d Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 18 Jan 2026 08:32:18 -0500 Subject: [PATCH 3/8] finish fixing up hash_cracker_validator --- modules/auxiliary/analyze/crack_windows.rb | 8 ++++++-- tools/dev/hash_cracker_validator.rb | 13 +++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index 39b19ee6c7f68..ea791c1ef2d8d 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -20,7 +20,11 @@ def initialize MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 is format 5600 in hashcat. - krb5tgs (Kerberos Tickets) is format 13100 in hashcat. + krb5tgs-rc4 is format 13100 in hashcat. + krb5tgs-aes128 is format 19600 in hashcat. + krb5tgs-aes256 is format 19700 in hashcat. + krb5asrep-rc4 is format 18200 in hashcat. + timeroast is format 31300 in hashcat. ), 'Author' => [ 'theLightCosine', @@ -48,7 +52,7 @@ def initialize OptBool.new('MSCASH', [false, 'Crack M$ CASH hashes (1 and 2)', true]), OptBool.new('NETNTLM', [false, 'Crack NetNTLM', true]), OptBool.new('NETNTLMV2', [false, 'Crack NetNTLMv2', true]), - OptBool.new('KERBEROS', [false, 'Crack krb5 related hashes', true]), + OptBool.new('KERBEROS', [false, 'Crack krb5/timeroast related hashes', true]), OptBool.new('INCREMENTAL', [false, 'Run in incremental mode', true]), OptBool.new('WORDLIST', [false, 'Run in wordlist mode', true]), OptBool.new('NORMAL', [false, 'Run in normal mode (John the Ripper only)', true]) diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index 87f376a2b398e..3ae1bb05bd897 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -191,6 +191,19 @@ def windows_hashes_and_regex_hashcat_compat cred_temp, regex_temp = windows_hashes_and_regex_john_compat creds_command << cred_temp creds_expected_output_regex += regex_temp +<<<<<<< HEAD +======= + creds_command << ' creds add user:krb5tgs-rc4 hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4;' + creds_expected_output_regex << %r{krb5tgs-rc4\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-rc4\s+Password1!$} + creds_command << ' creds add user:krb5tgs-aes128 hash:\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128;' + creds_expected_output_regex << /krb5tgs-aes128\s+\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958 \(TRUNCATED\)\s+ Nonreplayable hash\s+krb5tgs-aes128\s+hashcat$/ + creds_command << ' creds add user:krb5tgs-aes256 hash:\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256;' + creds_expected_output_regex << /krb5tgs-aes256\s+\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-aes256\s+hashcat$/ + creds_command << ' creds add user:krb5asrep-rc4 hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4;' + creds_expected_output_regex << /krb5asrep-rc4\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep-rc4\s+hashcat$/ + creds_command << ' creds add user:timeroast hash:\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast;' + creds_expected_output_regex << /timeroast\s+\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$9077336975368113429621409555671085 \(TRUNCATED\)\s+Nonreplayable hash\s+timeroast\s+hashcat$/ +>>>>>>> 5e4c422db9 (finish fixing up hash_cracker_validator) return creds_command, creds_expected_output_regex end From 1361d3414c1c102bc7403ae1e7a17b620abb4f8b Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 28 Jan 2026 09:47:57 -0500 Subject: [PATCH 4/8] take incoming --- .../Hashes-and-Password-Cracking.md | 22 ++++++++--------- .../framework/password_crackers/cracker.rb | 4 ++-- .../password_crackers/hashcat/formatter.rb | 4 ++-- modules/auxiliary/analyze/crack_windows.rb | 24 ++++++++++++------- .../framework/hashes/identify_spec.rb | 20 +++++++++++----- tools/dev/hash_cracker_validator.rb | 9 +++++-- 6 files changed, 51 insertions(+), 32 deletions(-) diff --git a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md index 50d0d1c928a3a..a310e576d0d24 100644 --- a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md +++ b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md @@ -71,10 +71,10 @@ This section will cover the differences between the two crackers. This is not a | blowfish | bcrypt | 3200 | lanman | lm | 3000 | NTLM | nt | 1000 -| krb5tgs-rc4 | krb5tgs | 13100 +| krb5tgs | krb5tgs | 13100 | krb5tgs-aes128 | | 19600 | krb5tgs-aes256 | | 19700 -| krb5asrep-rc4 | | 18200 +| krb5asrep | krb5asrep | 18200 | timeroast | | 31300 | mssql (05) | mssql | 131 | mssql12 | mssql12 | 1731 @@ -152,10 +152,10 @@ creds add user:u4-netntlm hash:u4-netntlm::kNS:338d08f8e26de93300000000000000000 creds add user:admin hash:admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030 jtr:netntlmv2 creds add user:mscash-test1 hash:M$test1#64cd29e36a8431a2b111378564a10631 jtr:mscash creds add user:mscash2-hashcat hash:$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2 -creds add user:krb5tgs-rc4 hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4 +creds add user:krb5tgs hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs creds add user:krb5tgs-aes128 hash:$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128 creds add user:krb5tgs-aes256 hash:$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256 -creds add user:krb5asrep-rc4 hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4 +creds add user:krb5asrep hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep creds add user:timeroast hash:$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast # sql creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05 @@ -194,8 +194,8 @@ creds add user:admin hash:'$pbkdf2-sha256$260000$Q1hzYjU5dFNMWm05QUJCTg$s.vmjGlI This data breaks down to the following table: -| **Hash Type** | **Username** | **Hash** | **Password** | **jtr format** | **Modules which dump this info** | **Modules which crack this** | -|:------------------------------------:|:------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------:|:--------------------:|:------------------------------------------------:|:---------------------------------------------------------:| +| **Hash Type** | **Username** | **Hash** | **Password** | **jtr format** | **Modules which dump this info** | **Modules which crack this** | +|:------------------------------------:|:------------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------:|:--------------------:|:------------------------------------------------:|:---------------------------------------------------------:| | DES | des_password | `rEK1ecacw.7.c` | password | des | post/aix/gather/hashdump | auxiliary/analyze/crack_aix auxiliary/analyze/crack_linux | | MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | | BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | @@ -208,11 +208,11 @@ This data breaks down to the following table: | NetNTLMv2 | admin | `admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030` | hashcat | netntlmv2 |   | auxiliary/analyze/crack_windows | | MSCash | mscash-test1 | `M$test1#64cd29e36a8431a2b111378564a10631` | test1 | mscash |   | auxiliary/analyze/crack_windows | | MSCash2 | mscash2-hashcat | `$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f` | hashcat | mscash2 |   | auxiliary/analyze/crack_windows | -| Kerberos (Kerberoast) | krb5tgs-rc4 | `$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab` | Password1! | krb5tgs-rc4 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | -| | krb5tgs-aes128 | `$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e` | hashcat | krb5tgs-aes128 | | auxiliary/analyze/crack_windows | -| | krb5tgs-aes256 | `$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0` | hashcat | krb5tgs-aes256 | | auxiliary/analyze/crack_windows | -| | krb5asrep-rc4 | `$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac` | hashcat | krb5asrep-rc4 | | auxiliary/analyze/crack_windows | -| | timeroast | | | timeroast | | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs | `$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab` | Password1! | krb5tgs | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs-aes128 | `$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e` | hashcat | krb5tgs-aes128 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs-aes256 | `$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0` | hashcat | krb5tgs-aes256 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| | krb5asrep | `$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac` | hashcat | krb5asrep-rc4 | auxiliary/gather/asrep | auxiliary/analyze/crack_windows | +| NTP Timeroast | timeroast | `$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380` | hashcat | timeroast | auxiliary/scanner/ntp/timeroast | auxiliary/analyze/crack_windows | | MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | | MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | | MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password1! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | diff --git a/lib/metasploit/framework/password_crackers/cracker.rb b/lib/metasploit/framework/password_crackers/cracker.rb index bd9c60cf21f77..6cc77ae928240 100644 --- a/lib/metasploit/framework/password_crackers/cracker.rb +++ b/lib/metasploit/framework/password_crackers/cracker.rb @@ -157,13 +157,13 @@ def jtr_format_to_hashcat_format(format) '5500' when 'netntlmv2' '5600' - when 'krb5tgs-rc4' + when 'krb5tgs' '13100' when 'krb5tgs-aes128' '19600' when 'krb5tgs-aes256' '19700' - when 'krb5asrep-rc4' + when 'krb5asrep' '18200' when 'timeroast' '31300' diff --git a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb index ed21733846862..1520023e4b083 100644 --- a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb +++ b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb @@ -134,8 +134,8 @@ def add_equals_to_base64(str) # when /^krb5$/ # return "#{cred.id}:#{cred.private.data}" when /^(krb5.|timeroast$)/ - # krb5tgs-rc4, krb5tgs-aes128, krb5tgs-aes256, krb5asrep-rc4, timeroast - ## hash-mode: 13100 19600 19700 18200 31300 + # krb5tgs, krb5tgs-aes128, krb5tgs-aes256, krb5asrep, timeroast + ## hash-mode: 13100 19600 19700 18200 31300 return "#{cred.id}:#{cred.private.data}" end end diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index ea791c1ef2d8d..491c6d9c280a4 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -20,10 +20,10 @@ def initialize MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 is format 5600 in hashcat. - krb5tgs-rc4 is format 13100 in hashcat. + krb5tgs is format 13100 in hashcat. krb5tgs-aes128 is format 19600 in hashcat. krb5tgs-aes256 is format 19700 in hashcat. - krb5asrep-rc4 is format 18200 in hashcat. + krb5asrep is format 18200 in hashcat. timeroast is format 31300 in hashcat. ), 'Author' => [ @@ -111,17 +111,23 @@ def check_results(passwords, results, hash_type, method) cred = { 'hash_type' => hash_type, 'method' => method } if @cracker_type == 'john' # If we don't have an expected minimum number of fields, this is probably not a hash line - next unless fields.count > 2 + next unless fields.count >= 2 # krb5asrep and similar kerberoast fields have 2 fields only - cred['username'] = fields.shift - cred['core_id'] = fields.pop case hash_type - when 'mscash', 'mscash2', 'netntlm', 'netntlmv2', 'krb5tgs' + when 'krb5asrep' + cred['core_id'] = fields.shift + cred['password'] = fields.pop + when 'mscash', 'mscash2', 'netntlm', 'netntlmv2' + cred['username'] = fields.shift + cred['core_id'] = fields.pop cred['password'] = fields.shift when 'lm', 'nt' # If we don't have an expected minimum number of fields, this is probably not a NTLM hash next unless fields.count >= 6 + cred['username'] = fields.shift + cred['core_id'] = fields.pop + 2.times { fields.pop } # Get rid of extra : nt_hash = fields.pop fields.pop @@ -151,7 +157,7 @@ def check_results(passwords, results, hash_type, method) if ['netntlm', 'netntlmv2'].include? hash_type # we could grab the username here, but no need since we grab it later based on core_id, which is safer 6.times { fields.shift } # Get rid of a bunch of extra fields - elsif ['krb5tgs-rc4', 'krb5asrep-rc4'].include? hash_type + elsif ['krb5tgs', 'krb5asrep'].include? hash_type 2.times { fields.shift } # Get rid of extra hash fields else cred['hash'] = fields.shift @@ -187,10 +193,10 @@ def run hash_types_to_crack << 'mscash2' if datastore['MSCASH'] hash_types_to_crack << 'netntlm' if datastore['NETNTLM'] hash_types_to_crack << 'netntlmv2' if datastore['NETNTLMV2'] - hash_types_to_crack << 'krb5tgs-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5tgs' if datastore['KERBEROS'] hash_types_to_crack << 'krb5tgs-aes128' if datastore['KERBEROS'] hash_types_to_crack << 'krb5tgs-aes256' if datastore['KERBEROS'] - hash_types_to_crack << 'krb5asrep-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5asrep' if datastore['KERBEROS'] hash_types_to_crack << 'timeroast' if datastore['KERBEROS'] jobs_to_do = [] diff --git a/spec/lib/metasploit/framework/hashes/identify_spec.rb b/spec/lib/metasploit/framework/hashes/identify_spec.rb index 0c610926ed036..4719710f77f64 100644 --- a/spec/lib/metasploit/framework/hashes/identify_spec.rb +++ b/spec/lib/metasploit/framework/hashes/identify_spec.rb @@ -299,10 +299,18 @@ end end - describe 'identify_krb5tgs-rc4' do - it 'returns krb5tgs-rc4' do + describe 'identify_krb5tgs_hashcat_format' do + it 'returns krb5tgs' do hash = described_class.identify_hash('$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab') - expect(hash).to match('krb5tgs-rc4') + expect(hash).to match('krb5tgs') + end + end + + describe 'identify_krb5tgs_john_format' do + it 'returns krb5tgs' do + # https://github.com/openwall/john/issues/5944#issuecomment-3772129757 + hash = described_class.identify_hash('$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab') + expect(hash).to match('krb5tgs') end end @@ -320,10 +328,10 @@ end end - describe 'identify_krb5asrep-rc4' do - it 'returns krb5asrep-rc4' do + describe 'identify_krb5asrep' do + it 'returns krb5asrep' do hash = described_class.identify_hash('$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac') - expect(hash).to match('krb5asrep-rc4') + expect(hash).to match('krb5asrep') end end diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index 3ae1bb05bd897..d425dfc640e32 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -182,6 +182,8 @@ def windows_hashes_and_regex_john_compat creds_expected_output_regex << /mscash-test1\s+M\$test1\#64cd29e36a8431a2b111378564a10631\s+Nonreplayable hash\s+mscash\s+test1$/ creds_command << ' creds add user:mscash2-hashcat hash:\$DCC2\$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2;' creds_expected_output_regex << /mscash2-hashcat\s+\$DCC2\$10240\#tom\#e4e938d12fe5974dc42a90120bd9c90f\s+Nonreplayable hash\s+mscash2\s+hashcat$/ + creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' + creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ return creds_command, creds_expected_output_regex end @@ -192,15 +194,18 @@ def windows_hashes_and_regex_hashcat_compat creds_command << cred_temp creds_expected_output_regex += regex_temp <<<<<<< HEAD +<<<<<<< HEAD ======= creds_command << ' creds add user:krb5tgs-rc4 hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4;' creds_expected_output_regex << %r{krb5tgs-rc4\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-rc4\s+Password1!$} +======= + creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' + creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} +>>>>>>> 89d15d6401 (john fixes) creds_command << ' creds add user:krb5tgs-aes128 hash:\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128;' creds_expected_output_regex << /krb5tgs-aes128\s+\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958 \(TRUNCATED\)\s+ Nonreplayable hash\s+krb5tgs-aes128\s+hashcat$/ creds_command << ' creds add user:krb5tgs-aes256 hash:\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256;' creds_expected_output_regex << /krb5tgs-aes256\s+\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-aes256\s+hashcat$/ - creds_command << ' creds add user:krb5asrep-rc4 hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4;' - creds_expected_output_regex << /krb5asrep-rc4\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep-rc4\s+hashcat$/ creds_command << ' creds add user:timeroast hash:\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast;' creds_expected_output_regex << /timeroast\s+\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$9077336975368113429621409555671085 \(TRUNCATED\)\s+Nonreplayable hash\s+timeroast\s+hashcat$/ >>>>>>> 5e4c422db9 (finish fixing up hash_cracker_validator) From d7c713639c082719ae1a7984467a58b06db74322 Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 26 Jan 2026 08:55:46 -0500 Subject: [PATCH 5/8] kerberoast cracking updates --- documentation/modules/auxiliary/gather/kerberoast.md | 2 +- lib/metasploit/framework/hashes.rb | 11 +++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/documentation/modules/auxiliary/gather/kerberoast.md b/documentation/modules/auxiliary/gather/kerberoast.md index ded67b551a4ec..16a804f46632b 100644 --- a/documentation/modules/auxiliary/gather/kerberoast.md +++ b/documentation/modules/auxiliary/gather/kerberoast.md @@ -66,7 +66,7 @@ $krb5tgs$23$*kerber.roastable$MSF.LOCAL$http/abc2.msf.local*$d335dc07b2c018de2a1 $krb5tgs$17$low.admin$MSF.LOCAL$*http/abc.msf.local*$a1c7c1c1e31e36cdb0721928$b69b48... [!] NOTE: Multiple encryption types returned - will require separate cracking runs for each type. [*] To obtain the crackable values for a praticular type, run `creds`: -[*] creds -t krb5tgs-rc4 -O 20.248.208.9 -o +[*] creds -t krb5tgs -O 20.248.208.9 -o [*] creds -t krb5tgs-aes128 -O 20.248.208.9 -o [*] Auxiliary module execution completed ``` diff --git a/lib/metasploit/framework/hashes.rb b/lib/metasploit/framework/hashes.rb index bb92d28a2c437..6eaeb5d3fc6c0 100644 --- a/lib/metasploit/framework/hashes.rb +++ b/lib/metasploit/framework/hashes.rb @@ -8,7 +8,6 @@ module Framework # http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats # https://openwall.info/wiki/john/sample-hashes # QNX formats -> https://moar.so/blog/qnx-password-hash-formats.html - # rubocop:disable Metrics/ModuleLength module Hashes JTR_NTLMV1 = 'netntlm'.freeze JTR_NTLMV2 = 'netntlmv2'.freeze @@ -67,9 +66,9 @@ def self.identify_hash(hash) return 'nt' when hash.length == 65 && hash =~ /^[\da-fA-F]{32}:[\da-fA-F]{32}$/ return 'lm' - when hash =~ /^[^\\\/:*?"<>|]{1,20}[:]{2,3}([^\\\/:*?"<>|]{1,20})?:[a-f0-9]{48}:[a-f0-9]{48}:[a-f0-9]{16}$/ + when hash =~ %r{^[^\\/:*?"<>|]{1,20}:{2,3}([^\\/:*?"<>|]{1,20})?:[a-f0-9]{48}:[a-f0-9]{48}:[a-f0-9]{16}$} return 'netntlm' - when hash =~ /^([^\\\/:*?"<>|]{1,20}\\)?[^\\\/:*?"<>|]{1,20}[:]{2,3}([^\\\/:*?"<>|]{1,20}:)?[^\\\/:*?"<>|]{1,20}:[a-f0-9]{32}:[a-f0-9]+$/ + when hash =~ %r{^([^\\/:*?"<>|]{1,20}\\)?[^\\/:*?"<>|]{1,20}:{2,3}([^\\/:*?"<>|]{1,20}:)?[^\\/:*?"<>|]{1,20}:[a-f0-9]{32}:[a-f0-9]+$} return 'netntlmv2' # OSX when hash.start_with?('$ml$') && hash.split('$').last.length == 256 @@ -124,18 +123,18 @@ def self.identify_hash(hash) when hash =~ /^\*?[\da-fA-F]{32}\*[\da-fA-F]{32}$/ # we accept the beginning star as optional return 'vnc' - when hash =~ /^\$pbkdf2-sha256\$[0-9]+\$[a-z0-9\/.]+\$[a-z0-9\/.]{43}$/i + when hash =~ %r{^\$pbkdf2-sha256\$[0-9]+\$[a-z0-9/.]+\$[a-z0-9/.]{43}$}i return 'pbkdf2-sha256' when hash =~ /^\$sntp-ms\$[\da-fA-F]{32}\$[\da-fA-F]{96}$/ return 'timeroast' when hash =~ /^\$krb5tgs\$23\$\*.+\$[\da-fA-F]{32}\$[\da-fA-F]+$/ - return 'krb5tgs-rc4' + return 'krb5tgs' when hash =~ /^\$krb5tgs\$18\$.+\$[\da-fA-F]{24}\$[\da-fA-F]+$/ return 'krb5tgs-aes256' when hash =~ /^\$krb5tgs\$17\$.+\$[\da-fA-F]{24}\$[\da-fA-F]+$/ return 'krb5tgs-aes128' when hash =~ /^\$krb5asrep\$23\$[^:]+:[\da-fA-F]{32}\$[\da-fA-F]+$/ - return 'krb5asrep-rc4' + return 'krb5asrep' # hashcat is krb5asrep-rc4, but we use john format end '' end From f4d979f5e6ac052bdc896ecf5df14860521eeaed Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 28 Jan 2026 09:56:22 -0500 Subject: [PATCH 6/8] remove bad rebase items --- tools/dev/hash_cracker_validator.rb | 8 -------- 1 file changed, 8 deletions(-) diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index d425dfc640e32..e6490e0273d0d 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -193,22 +193,14 @@ def windows_hashes_and_regex_hashcat_compat cred_temp, regex_temp = windows_hashes_and_regex_john_compat creds_command << cred_temp creds_expected_output_regex += regex_temp -<<<<<<< HEAD -<<<<<<< HEAD -======= - creds_command << ' creds add user:krb5tgs-rc4 hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4;' - creds_expected_output_regex << %r{krb5tgs-rc4\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-rc4\s+Password1!$} -======= creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} ->>>>>>> 89d15d6401 (john fixes) creds_command << ' creds add user:krb5tgs-aes128 hash:\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128;' creds_expected_output_regex << /krb5tgs-aes128\s+\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958 \(TRUNCATED\)\s+ Nonreplayable hash\s+krb5tgs-aes128\s+hashcat$/ creds_command << ' creds add user:krb5tgs-aes256 hash:\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256;' creds_expected_output_regex << /krb5tgs-aes256\s+\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-aes256\s+hashcat$/ creds_command << ' creds add user:timeroast hash:\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast;' creds_expected_output_regex << /timeroast\s+\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$9077336975368113429621409555671085 \(TRUNCATED\)\s+Nonreplayable hash\s+timeroast\s+hashcat$/ ->>>>>>> 5e4c422db9 (finish fixing up hash_cracker_validator) return creds_command, creds_expected_output_regex end From e01f5f93627c280fca9c8a1952e6e6ebefce2042 Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 1 Feb 2026 17:48:14 -0500 Subject: [PATCH 7/8] hash_crack_validator rewite and john krb5tgs working --- .../password_crackers/jtr/formatter.rb | 5 +- modules/auxiliary/analyze/crack_windows.rb | 2 +- tools/dev/hash_cracker_validator.rb | 723 ++++++------------ 3 files changed, 244 insertions(+), 486 deletions(-) diff --git a/lib/metasploit/framework/password_crackers/jtr/formatter.rb b/lib/metasploit/framework/password_crackers/jtr/formatter.rb index 1b09fa9b08556..7f3183738e70f 100644 --- a/lib/metasploit/framework/password_crackers/jtr/formatter.rb +++ b/lib/metasploit/framework/password_crackers/jtr/formatter.rb @@ -97,7 +97,10 @@ def self.params_to_jtr(username, private_data, private_type, format: nil, db_id: # for this we overload the username field with the db_id so we can find it in the db easier later # https://github.com/openwall/john/issues/5944 private_data = private_data.split('$') - private_data[5] = private_data[5].split(':').first + # remove port if there is one + if private_data[5].include?(':') + private_data[5] = private_data[5].split(':').first + '*' + end private_data = private_data.join('$') return "#{db_id}:#{private_data}" when /^(krb5.|timeroast$)/ diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index 491c6d9c280a4..da7d1c1cebbf6 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -114,7 +114,7 @@ def check_results(passwords, results, hash_type, method) next unless fields.count >= 2 # krb5asrep and similar kerberoast fields have 2 fields only case hash_type - when 'krb5asrep' + when 'krb5asrep', 'krb5tgs' cred['core_id'] = fields.shift cred['password'] = fields.pop when 'mscash', 'mscash2', 'netntlm', 'netntlmv2' diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index e6490e0273d0d..3d22ebc75be94 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -56,6 +56,9 @@ end end.parse! +# expose options to methods +$options = options + # colors and puts templates from msftidy.rb class String @@ -184,6 +187,8 @@ def windows_hashes_and_regex_john_compat creds_expected_output_regex << /mscash2-hashcat\s+\$DCC2\$10240\#tom\#e4e938d12fe5974dc42a90120bd9c90f\s+Nonreplayable hash\s+mscash2\s+hashcat$/ creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ + creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' + creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB\.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} return creds_command, creds_expected_output_regex end @@ -273,6 +278,49 @@ def run_msfconsole(command, expected_output_regexes) end end +# return the common setg base settings string +def base_settings(wordlist: true) + s = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; ' + s << 'setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; ' + s << (wordlist ? 'setg WORDLIST true; ' : 'setg WORDLIST false; ') + s << 'setg verbose true;' + s +end + +# Run a test section using the provided creds proc and analyzer. +# creds_proc should return [creds_command, creds_expected_output_regex] +def run_section(desc:, creds_proc:, analyzer:, use_wordlist: true, action: nil, pot_path: nil, skip_base_settings: false) + info desc + tempfile = nil + begin + tempfile = Tempfile.new('john_pot') unless pot_path + creds_expected_output_regex = [] + creds_command = skip_base_settings ? '' : base_settings(wordlist: use_wordlist) + + cred_temp, regex_temp = creds_proc.call + creds_command << cred_temp + creds_expected_output_regex += regex_temp + + creds_command << " use #{analyzer};" + creds_command << " set CUSTOM_WORDLIST #{$wordlist.path};" if use_wordlist + creds_command << " set POT #{pot_path || tempfile.path};" + creds_command << " set action #{action};" if action + creds_command << ' run; creds -d; exit;' + + info "Run Command: #{creds_command}" if $options[:verbose] + success = run_msfconsole(creds_command, creds_expected_output_regex) + unless success + error 'Credential verification failed. Exiting.' + exit 1 + end + ensure + if tempfile + tempfile.close! + tempfile.unlink + end + end +end + if options[:test] == 'all' || options[:test].include?(1) info '[1/24] Checking Metasploit database connection...' db_status_command = 'db_status; exit' @@ -288,555 +336,262 @@ def run_msfconsole(command, expected_output_regexes) File.open(wordlist, 'w') { |file| file.write("password\nhashcat\ntest1\ntoto\nfoo\nPassword1!\nprobe\ntere\na\nTHALES\nepsilon\n1234\nTestPass123#\npasswor\nd\n") } info "Wordlist file created at: #{wordlist.path}" +# expose the wordlist to methods (methods don't capture local variables) +$wordlist = wordlist + +# Create a john pot tempfile used by the pot-mode tests +pot_file = Tempfile.new('john_pot') +info "Pot file created at: #{pot_file.path}" + if options[:test] == 'all' || options[:test].include?(2) - info '[2/24] Running *nix hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[2/24] Running *nix hashes in john wordlist mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(3) - info '[3/24] Running windows hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[3/24] Running windows hashes in john wordlist mode...', + creds_proc: method(:windows_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(4) - info '[4/24] Running sql hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[4/24] Running sql hashes in john wordlist mode...', + creds_proc: method(:sql_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(5) - info '[5/24] Running osx hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[5/24] Running osx hashes in john wordlist mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(6) - info '[6/24] Running webapp hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[6/24] Running webapp hashes in john wordlist mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(7) - info '[7/24] Running *nix hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[7/24] Running *nix hashes in hashcat wordlist mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(8) - info '[8/24] Running windows hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[8/24] Running windows hashes in hashcat wordlist mode...', + creds_proc: method(:windows_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(9) - info '[9/24] Running sql hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[9/24] Running sql hashes in hashcat wordlist mode...', + creds_proc: method(:sql_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(10) - info '[10/24] Running mobile hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = mobile_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_mobile;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[10/24] Running mobile hashes in hashcat wordlist mode...', + creds_proc: method(:mobile_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_mobile', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(11) - info '[11/24] Running osx hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[11/24] Running osx hashes in hashcat wordlist mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(12) - info '[12/24] Running webapp hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink -end - -wordlist.close! -wordlist.unlink - -pot_file = Tempfile.new('john_pot') -File.open(pot_file, 'w') { |file| file.write("$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/:password\nrEK1ecacw.7.c:password\n_J9..K0AyUubDrfOgO4s:password\n$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe:password\n$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5:password\n$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1:password\n$LM$4a3b108f3fa6cb6d:D\n$LM$e52cac67419a9a22:PASSWOR\n$NT$8846f7eaee8fb117ad06bdd830b7586c:password\nM$test1#64cd29e36a8431a2b111378564a10631:test1\n$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f:hashcat\n$NETNTLM$cb8086049ec4736c338d08f8e26de933$9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:hashcat\n$NETNTLMv2$ADMINN46iSNekpT$08ca45b7d7ea58ee$88dcbe4446168966a153a0064958dac6$5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat\n0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254:FOO\n0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908:toto\n0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16:Password1!\n445ff82636a7ba59:probe\n*5AD8F88516BD021DD43F171E2C785C69F8E54ADB:tere\nO$SIMON#4f8bc1809cb2af77:A\nO$SYSTEM#9eedfa0ad26c6d52:THALES\n9860a48ca459d054f3fef0f8518cf6872923dae2:81fcb23bcadd6c5:1234\nd1b19a90b87fc10c304e657f37162445dae27d16:a006983800cc3dd1:1234\n1c0a0fdb673fba36beaeb078322c7393:81fcb23bcadd6c5:1234\n1430823483D07626EF8BE3FDA2FF056D0DFD818DBFE47683:hashcat\n$LION$648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d:hashcat\n$pbkdf2-hmac-sha512$35460.93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05.752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222:hashcat\n$pbkdf2-hmac-sha1$10000$37323237333437363735323036323731$d0c38acef03f149b4b37c5a8319feeefcbd34912127ba96f3dfa5c22f49bbc1a:hashcat\n$H$984478476IagS59wHZvyQMArzfx58u.:hashcat\n$P$984478476IagS59wHZvyQMArzfx58u.:hashcat\n$B$56668501$0ce106caa70af57fd525aeaf80ef2898:hashcat\ne52cac67419a9a22:PASSWOR\n4a3b108f3fa6cb6d:D\n8846f7eaee8fb117ad06bdd830b7586c:password\n64cd29e36a8431a2b111378564a10631:test1:test1\nu4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c:hashcat\nADMIN::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat\n5ad8f88516bd021dd43f171e2c785c69f8e54adb:tere\n648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d:hashcat\n$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222:hashcat\n{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa:hashcat\n") } -info "john.pot file created at: #{pot_file.path}" - -if options[:test] == 'all' || options[:test].include?(13) - info '[13/24] Running *nix hashes in john pot mode...' - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[12/24] Running webapp hashes in hashcat wordlist mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(14) - info '[14/24] Running windows hashes in john pot mode...' + run_section( + desc: '[14/24] Running windows hashes in john pot mode...', + creds_proc: method(:windows_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: false, + pot_path: pot_file.path + ) +end - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end +if options[:test] == 'all' || options[:test].include?(13) + run_section( + desc: '[13/24] Running *nix hashes in john pot mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(15) - info '[15/24] Running sql hashes in john pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[15/24] Running sql hashes in john pot mode...', + creds_proc: method(:sql_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(16) - info '[16/24] Running osx hashes in john pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[16/24] Running osx hashes in john pot mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(17) - info '[17/24] Running webapp hashes in john pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[17/24] Running webapp hashes in john pot mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(18) - info '[18/24] Running *nix hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[18/24] Running *nix hashes in hashcat pot mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(19) - info '[19/24] Running windows hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[19/24] Running windows hashes in hashcat pot mode...', + creds_proc: method(:windows_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(20) - info '[20/24] Running sql hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[20/24] Running sql hashes in hashcat pot mode...', + creds_proc: method(:sql_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(21) - info '[21/24] Running mobile hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = mobile_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_mobile;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[21/24] Running mobile hashes in hashcat pot mode...', + creds_proc: method(:mobile_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_mobile', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(22) - info '[22/24] Running osx hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[22/24] Running osx hashes in hashcat pot mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(23) - info '[23/24] Running webapp hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[23/24] Running webapp hashes in hashcat pot mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(24) - info '[24/24] Running all hashes in john apply_pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = windows_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = sql_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/apply_pot;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[24/24] Running all hashes in john apply_pot mode...', + creds_proc: proc { + creds_command = 'setg verbose true;' + creds_expected_output_regex = [] + cred_temp, regex_temp = nix_hashes_and_regex + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = windows_hashes_and_regex_john_compat + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = sql_hashes_and_regex_john_compat + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = osx_hashes_and_regex + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = webapp_hashes_and_regex + creds_command << cred_temp + creds_expected_output_regex += regex_temp + [creds_command, creds_expected_output_regex] + }, + analyzer: 'auxiliary/analyze/apply_pot', + use_wordlist: false, + pot_path: pot_file.path, + skip_base_settings: true + ) end pot_file.close! From d0486634fa95da5e94b9e84a19a5c97e5a6964aa Mon Sep 17 00:00:00 2001 From: LSUDOKO Date: Thu, 12 Mar 2026 01:21:34 +0530 Subject: [PATCH 8/8] Fix cracked credentials not displaying for multiple Kerberos hash types --- lib/msf/ui/console/command_dispatcher/creds.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/creds.rb b/lib/msf/ui/console/command_dispatcher/creds.rb index 7228275b99606..94d06485dace1 100644 --- a/lib/msf/ui/console/command_dispatcher/creds.rb +++ b/lib/msf/ui/console/command_dispatcher/creds.rb @@ -574,9 +574,12 @@ def filter_cred_cores(cores, opts, origin_ranges, host_ranges) # Some creds may have been cracked that exist outside of the filtered cores list, let's resolve them all to show the cracked value cores_by_id = cores.each_with_object({}) { |core, hash| hash[core.id] = core } # Map of any originating core ids that have been cracked; The value is cracked core value + # Note: Multiple cracked cores may exist for the same originating core (e.g., same hash cracked via different methods) + # We only need one cracked core per originating core for display purposes, so we keep the first one found cracked_core_id_to_cracked_value = cores.each_with_object({}) do |core, hash| next unless core.origin.kind_of?(Metasploit::Credential::Origin::CrackedPassword) - hash[core.origin.metasploit_credential_core_id] = core + originating_core_id = core.origin.metasploit_credential_core_id + hash[originating_core_id] ||= core # Only set if not already present end cores.each do |core|