From bc26fedf5ceddca603c5a4acce511b2c8b80bb21 Mon Sep 17 00:00:00 2001 From: h00die Date: Sat, 17 Jan 2026 13:21:42 -0500 Subject: [PATCH 01/12] kerberoast hash types added for cracking --- .../Hashes-and-Password-Cracking.md | 196 ++++++++++-------- .../framework/password_crackers/cracker.rb | 16 +- .../framework/hashes/identify_spec.rb | 28 +++ 3 files changed, 146 insertions(+), 94 deletions(-) diff --git a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md index 75543255981d9..219f546fe9398 100644 --- a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md +++ b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md @@ -10,11 +10,11 @@ Many modules dump hashes from various software. Anything from the OS: [Windows] In this first, simple, example we will simply show loading the library and calling its function. ```ruby -require 'metasploit/framework/hashes/identify' -puts identify_hash "$1$28772684$iEwNOgGugqO9.bIz5sk8k/" +require 'metasploit/framework/hashes' +puts Metasploit::Framework::Hashes.identify_hash("$1$28772684$iEwNOgGugqO9.bIz5sk8k/") # note, bad hashes return an empty string since nil is not accepted when creating credentials in msf. -puts identify_hash "This_is a Fake Hash" -puts identify_hash "_9G..8147mpcfKT8g0U." +puts Metasploit::Framework::Hashes.identify_hash("This_is a Fake Hash") +puts Metasploit::Framework::Hashes.identify_hash("_9G..8147mpcfKT8g0U.") ``` In practice, we receive the following output from this: ```ruby @@ -23,15 +23,15 @@ msf > irb [*] You are in the "framework" object irb: warn: can't alias jobs from irb_jobs. ->> require 'metasploit/framework/hashes/identify' +>> require 'metasploit/framework/hashes' => false ->> puts identify_hash "$1$28772684$iEwNOgGugqO9.bIz5sk8k/" +>> puts Metasploit::Framework::Hashes.identify_hash("$1$28772684$iEwNOgGugqO9.bIz5sk8k/") md5 => nil ->> puts identify_hash "This_is a Fake Hash" +>> puts Metasploit::Framework::Hashes.identify_hash("This_is a Fake Hash") => nil ->> puts identify_hash "_9G..8147mpcfKT8g0U." +>> puts Metasploit::Framework::Hashes.identify_hash("_9G..8147mpcfKT8g0U.") des,bsdi,crypt ``` @@ -42,58 +42,63 @@ This section will cover the differences between the two crackers. This is not a ### General Settings -| Description | JtR | hashcat | +| Description | JtR | hashcat | --------------- | ---------------- | ------------------- | -| session | `--session` | `--session` | +| session | `--session` | `--session` | no logging | `--no-log` | `--logfile-disable` | -| config file | `--config` | (n/a) | -| previous cracks | `--pot` | `--potfile-path` | -| type of hashes | `--format` | `--hash-type` | -| wordlist | `--wordlist` | (last parameter) | -| incremental | `--incremental` | `--increment` | -| rules | `--rules` | `--rules-file` | -| max run time | `--max-run-time` | `--runtime` | -| show results | `--show` | `--show` | +| config file | `--config` | (n/a) +| previous cracks | `--pot` | `--potfile-path` +| type of hashes | `--format` | `--hash-type` +| wordlist | `--wordlist` | (last parameter) +| incremental | `--incremental` | `--increment` +| rules | `--rules` | `--rules-file` +| max run time | `--max-run-time` | `--runtime` +| show results | `--show` | `--show` ### Hash Setting | Hash | JtR | [hashcat](https://hashcat.net/wiki/doku.php?id=example_hashes) | | --------------------------- | ------------------------------------------------------ | -------------------------------------------------------------- | -| List formats | `john --list=formats` `john --list=format-all-details` | `hashcat -h` | -| | | | -| cram-md5 | hmac-md5 | 10200 | -| des | descrypt | 1500 | -| md5 (crypt is $1$) | md5crypt | 500 | -| sha1 | | 100 | -| bsdi | bsdicrypt | 12400 | -| sha256 | sha256crypt | 7400 | -| sha512 | sha512crypt | 1800 | -| blowfish | bcrypt | 3200 | -| lanman | lm | 3000 | -| NTLM | nt | 1000 | -| mssql (05) | mssql | 131 | -| mssql12 | mssql12 | 1731 | -| mssql (2012/2014) | mssql05 | 132 | -| oracle (10) | oracle | 3100 | -| oracle 11 | oracle11 | 112 | -| oracle 12 | oracle12c | 12300 | -| postgres | dynamic_1034 | 12 | -| mysql | mysql | 200 | -| mysql-sha1 | mysql-sha1 | 300 | -| sha512($p.$s) - vmware ldap | dynamic_82 | 1710 | -| md5 (raw, unicode) | Raw-MD5u | 30 (with an empty salt) | -| NetNTLMv1 | netntlm | 5500 | -| NetNTLMv2 | netntlmv2 | 5600 | -| pbkdf2-sha256 | PBKDF2-HMAC-SHA256 | 10900 | -| Android (Samsung) SHA1 | | 5800 | -| Android (non-Samsung) SHA1 | | 110 | -| Android MD5 | | 10 | -| xsha | xsha | 122 | -| xsha512 | xsha512 | 1722 | -| PBKDF2-HMAC-SHA512 | PBKDF2-HMAC-SHA512 | 7100 | -| PBKDF2-HMAC-SHA1 | PBKDF2-HMAC-SHA1 | 12001 | -| PHPass | phpass | 400 | -| mediawiki | mediawiki | 3711 | +| List formats | `john --list=formats` `john --list=format-all-details` | `hashcat -h` +| | | +| cram-md5 | hmac-md5 | 10200 +| des | descrypt | 1500 +| md5 (crypt is $1$) | md5crypt | 500 +| sha1 | | 100 +| bsdi | bsdicrypt | 12400 +| sha256 | sha256crypt | 7400 +| sha512 | sha512crypt | 1800 +| blowfish | bcrypt | 3200 +| lanman | lm | 3000 +| NTLM | nt | 1000 +| krb5tgs-rc4 | krb5tgs | 13100 +| krb5tgs-aes128 | | 19600 +| krb5tgs-aes256 | | 19700 +| krb5asrep-rc4 | | 18200 +| timeroast | | 31300 +| mssql (05) | mssql | 131 +| mssql12 | mssql12 | 1731 +| mssql (2012/2014) | mssql05 | 132 +| oracle (10) | oracle | 3100 +| oracle 11 | oracle11 | 112 +| oracle 12 | oracle12c | 12300 +| postgres | dynamic_1034 | 12 +| mysql | mysql | 200 +| mysql-sha1 | mysql-sha1 | 300 +| sha512($p.$s) - vmware ldap | dynamic_82 | 1710 +| md5 (raw, unicode) | Raw-MD5u | 30 (with an empty salt) +| NetNTLMv1 | netntlm | 5500 +| NetNTLMv2 | netntlmv2 | 5600 +| pbkdf2-sha256 | PBKDF2-HMAC-SHA256 | 10900 +| Android (Samsung) SHA1 | | 5800 +| Android (non-Samsung) SHA1 | | 110 +| Android MD5 | | 10 +| xsha | xsha | 122 +| xsha512 | xsha512 | 1722 +| PBKDF2-HMAC-SHA512 | PBKDF2-HMAC-SHA512 | 7100 +| PBKDF2-HMAC-SHA1 | PBKDF2-HMAC-SHA1 | 12001 +| PHPass | phpass | 400 +| mediawiki | mediawiki | 3711 While Metasploit standardizes with the JtR format, the hashcat [library](https://github.com/rapid7/metasploit-framework/blob/master/lib/metasploit/framework/password_crackers/cracker.rb) includes the `jtr_format_to_hashcat_format` function to translate from jtr to hashcat. @@ -147,6 +152,11 @@ creds add user:u4-netntlm hash:u4-netntlm::kNS:338d08f8e26de93300000000000000000 creds add user:admin hash:admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030 jtr:netntlmv2 creds add user:mscash-test1 hash:M$test1#64cd29e36a8431a2b111378564a10631 jtr:mscash creds add user:mscash2-hashcat hash:$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2 +creds add user:krb5tgs-rc4 hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4 +creds add user:krb5tgs-aes128 hash:$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128 +creds add user:krb5tgs-aes256 hash:$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256 +creds add user:krb5asrep-rc4 hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4 +creds add user:timeroast hash: jtr:timeroast # sql creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05 creds add user:mssql_foo hash:0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254 jtr:mssql @@ -184,44 +194,48 @@ creds add user:admin hash:'$pbkdf2-sha256$260000$Q1hzYjU5dFNMWm05QUJCTg$s.vmjGlI This data breaks down to the following table: -| Hash Type | Username | Hash | Password | jtr format | Modules which dump this info | Modules which crack this | -| ------------------------------------ | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | -------------------- | ------------------------------------------------ | --------------------------------------------------------- | -| ----------- | ---------- | ------ | ---------- | ------------ | ------------------------------ | ------------------------- | -| DES | des_password | `rEK1ecacw.7.c` | password | des | post/aix/gather/hashdump | auxiliary/analyze/crack_aix auxiliary/analyze/crack_linux | -| MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| SHA256 | sha256_password | `$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5` | password | sha256,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| SHA512 | sha512_password | `$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1` | password | sha512,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| Blowfish | blowfish_password | `$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe` | password | bf | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | -| Lanman | lm_password | `E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C` | password | lm | post/windows/gather/hashdump | auxiliary/analyze/crack_windows | -| NTLM | nt_password | `AAD3B435B51404EEAAD3B435B51404EE:8846F7EAEE8FB117AD06BDD830B7586C` | password | nt | post/linux/gather/hashdump | auxiliary/analyze/crack_windows | -| NetNTLMv1 | u4-netntlm | `u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c` | hashcat | netntlm | | auxiliary/analyze/crack_windows | -| NetNTLMv2 | admin | `admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030` | hashcat | netntlmv2 | | auxiliary/analyze/crack_windows | -| MSCash | mscash-test1 | `M$test1#64cd29e36a8431a2b111378564a10631` | test1 | mscash | | auxiliary/analyze/crack_windows | -| MSCash2 | mscash2-hashcat | `$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f` | hashcat | mscash2 | | auxiliary/analyze/crack_windows | -| MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | -| MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | -| MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password1! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | -| MySQL | mysql_probe | `445ff82636a7ba59` | probe | mysql | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | -| MySQL SHA1 | mysql-sha1_tere | `*5AD8F88516BD021DD43F171E2C785C69F8E54ADB` | tere | mysql-sha1 | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | -| Oracle | simon | `4F8BC1809CB2AF77` | A | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle | SYSTEM | `9EEDFA0AD26C6D52` | THALES | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle 11 | DEMO | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle 11 | oracle11_epsilon | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | modules/auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Oracle 12 | oracle12_epsilon | `H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B` | epsilon | pbkdf2,oracle12c | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | -| Postgres | example | `md5be86a79bf2043622d58d5453c47d4860` | password | raw-md5,postgres | auxiliary/scanner/postgres/postgres_hashdump | auxiliary/analyze/crack_databases | -| Android (Samsung) SHA1 | samsungsha1 | `D1B19A90B87FC10C304E657F37162445DAE27D16:a006983800cc3dd1` | 1234 | android-samsung-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | -| Android (non-Samsung) SHA1 | androidsha1 | `9860A48CA459D054F3FEF0F8518CF6872923DAE2:81fcb23bcadd6c5` | 1234 | android-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | -| Android MD5 | androidmd5 | `1C0A0FDB673FBA36BEAEB078322C7393:81fcb23bcadd6c5` | 1234 | android-md5 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | -| OSX 10.4-10.6 | xsha_hashcat | `1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683` | hashcat | xsha | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | -| OSX 10.8+ | pbkdf2_hashcat | `$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f9$` | hashcat | PBKDF2-HMAC-SHA512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | -| OSX 10.7 | xsha512_hashcat | `648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d` | hashcat | xsha512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | -| HMAC-MD5 | hmac_password | `<3263520797@127.0.0.1>#3f089332842764e71f8400ede97a84c9` | password | hmac-md5 | auxiliary/server/capture/smtp | | -| SHA512($p.$s)/dynamic_82/vmware ldap | vmware_ldap | `$dynamic_82$a702505b8a67b45065a6a7ff81ec6685f08d06568e478e1a7695484a934b19a28b94f58595d4de68b27771362bc2b52444a0ed03e980e11ad5e5ffa6daa9e7e1$HEX$171ada255464a439569352c60258e7c6` | TestPass123# | dynamic_82 | | | -| MediaWiki | mediawiki_hashcat | `$B$56668501$0ce106caa70af57fd525aeaf80ef2898` | hashcat | mediawiki | | modules/auxiliary/analyze/crack_webapps | -| PHPPass (P type) | phpass_p_hashcat | `$P$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass | | modules/auxiliary/analyze/crack_webapps | -| PHPPass (H type) | phpass_h_hashcat | `$H$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass | | modules/auxiliary/analyze/crack_webapps | -| Atlassian | atlassian_hashcat | `{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa` | hashcat | PBKDF2-HMAC-SHA1 | | modules/auxiliary/analyze/crack_webapps | +| **Hash Type** | **Username** | **Hash** | **Password** | **jtr format** | **Modules which dump this info** | **Modules which crack this** | +|:------------------------------------:|:------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------:|:--------------------:|:------------------------------------------------:|:---------------------------------------------------------:| +| DES | des_password | `rEK1ecacw.7.c` | password | des | post/aix/gather/hashdump | auxiliary/analyze/crack_aix auxiliary/analyze/crack_linux | +| MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| SHA256 | sha256_password | `$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5` | password | sha256,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| SHA512 | sha512_password | `$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1` | password | sha512,crypt | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| Blowfish | blowfish_password | `$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe` | password | bf | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | +| Lanman | lm_password | `E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C` | password | lm | post/windows/gather/hashdump | auxiliary/analyze/crack_windows | +| NTLM | nt_password | `AAD3B435B51404EEAAD3B435B51404EE:8846F7EAEE8FB117AD06BDD830B7586C` | password | nt | post/linux/gather/hashdump | auxiliary/analyze/crack_windows | +| NetNTLMv1 | u4-netntlm | `u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c` | hashcat | netntlm |   | auxiliary/analyze/crack_windows | +| NetNTLMv2 | admin | `admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030` | hashcat | netntlmv2 |   | auxiliary/analyze/crack_windows | +| MSCash | mscash-test1 | `M$test1#64cd29e36a8431a2b111378564a10631` | test1 | mscash |   | auxiliary/analyze/crack_windows | +| MSCash2 | mscash2-hashcat | `$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f` | hashcat | mscash2 |   | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs-rc4 | `$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab` | Password1! | krb5tgs-rc4 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| | krb5tgs-aes128 | `$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e` | hashcat | krb5tgs-aes128 | | auxiliary/analyze/crack_windows | +| | krb5tgs-aes256 | `$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0` | hashcat | krb5tgs-aes256 | | auxiliary/analyze/crack_windows | +| | krb5asrep-rc4 | `$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac` | hashcat | krb5asrep-rc4 | | auxiliary/analyze/crack_windows | +| | timeroast | | | timeroast | | auxiliary/analyze/crack_windows | +| MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | +| MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | +| MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password1! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | +| MySQL | mysql_probe | `445ff82636a7ba59` | probe | mysql | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | +| MySQL SHA1 | mysql-sha1_tere | `*5AD8F88516BD021DD43F171E2C785C69F8E54ADB` | tere | mysql-sha1 | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases | +| Oracle | simon | `4F8BC1809CB2AF77` | A | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle | SYSTEM | `9EEDFA0AD26C6D52` | THALES | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle 11 | DEMO | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle 11 | oracle11_epsilon | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | modules/auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Oracle 12 | oracle12_epsilon | `H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B` | epsilon | pbkdf2,oracle12c | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases | +| Postgres | example | `md5be86a79bf2043622d58d5453c47d4860` | password | raw-md5,postgres | auxiliary/scanner/postgres/postgres_hashdump | auxiliary/analyze/crack_databases | +| Android (Samsung) SHA1 | samsungsha1 | `D1B19A90B87FC10C304E657F37162445DAE27D16:a006983800cc3dd1` | 1234 | android-samsung-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | +| Android (non-Samsung) SHA1 | androidsha1 | `9860A48CA459D054F3FEF0F8518CF6872923DAE2:81fcb23bcadd6c5` | 1234 | android-sha1 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | +| Android MD5 | androidmd5 | `1C0A0FDB673FBA36BEAEB078322C7393:81fcb23bcadd6c5` | 1234 | android-md5 | post/android/gather/hashdump | modules/auxiliary/analyze/crack_mobile | +| OSX 10.4-10.6 | xsha_hashcat | `1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683` | hashcat | xsha | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | +| OSX 10.8+ | pbkdf2_hashcat | `$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f9$` | hashcat | PBKDF2-HMAC-SHA512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | +| OSX 10.7 | xsha512_hashcat | `648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d` | hashcat | xsha512 | post/osx/gather/hashdump | modules/auxiliary/analyze/crack_osx | +| HMAC-MD5 | hmac_password | `<3263520797@127.0.0.1>#3f089332842764e71f8400ede97a84c9` | password | hmac-md5 | auxiliary/server/capture/smtp |   | +| SHA512($p.$s)/dynamic_82/vmware ldap | vmware_ldap | `$dynamic_82$a702505b8a67b45065a6a7ff81ec6685f08d06568e478e1a7695484a934b19a28b94f58595d4de68b27771362bc2b52444a0ed03e980e11ad5e5ffa6daa9e7e1$HEX$171ada255464a439569352c60258e7c6` | TestPass123# | dynamic_82 |   |   | +| MediaWiki | mediawiki_hashcat | `$B$56668501$0ce106caa70af57fd525aeaf80ef2898` | hashcat | mediawiki |   | modules/auxiliary/analyze/crack_webapps | +| PHPPass (P type) | phpass_p_hashcat | `$P$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass |   | modules/auxiliary/analyze/crack_webapps | +| PHPPass (H type) | phpass_h_hashcat | `$H$984478476IagS59wHZvyQMArzfx58u.` | hashcat | phpass |   | modules/auxiliary/analyze/crack_webapps | +| Atlassian | atlassian_hashcat | `{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa` | hashcat | PBKDF2-HMAC-SHA1 |   | modules/auxiliary/analyze/crack_webapps | # Adding a New Hash diff --git a/lib/metasploit/framework/password_crackers/cracker.rb b/lib/metasploit/framework/password_crackers/cracker.rb index 318db65e2decb..bd9c60cf21f77 100644 --- a/lib/metasploit/framework/password_crackers/cracker.rb +++ b/lib/metasploit/framework/password_crackers/cracker.rb @@ -119,9 +119,9 @@ def initialize(attributes = {}) public_send("#{attribute}=", value) end end - + def get_type - self.cracker + cracker end # This method takes a {framework.db.cred.private.jtr_format} (string), and @@ -157,6 +157,16 @@ def jtr_format_to_hashcat_format(format) '5500' when 'netntlmv2' '5600' + when 'krb5tgs-rc4' + '13100' + when 'krb5tgs-aes128' + '19600' + when 'krb5tgs-aes256' + '19700' + when 'krb5asrep-rc4' + '18200' + when 'timeroast' + '31300' # dbs when 'mssql' '131' @@ -576,7 +586,7 @@ def show_command end cmd << hash_path end - + def get_hashcat # Look in the Environment PATH for the hashcat binary self.cracker = 'hashcat' diff --git a/spec/lib/metasploit/framework/hashes/identify_spec.rb b/spec/lib/metasploit/framework/hashes/identify_spec.rb index d2dd49d13bcb0..448650f24c9d0 100644 --- a/spec/lib/metasploit/framework/hashes/identify_spec.rb +++ b/spec/lib/metasploit/framework/hashes/identify_spec.rb @@ -299,6 +299,34 @@ end end + describe 'identify_krb5tgs-rc4' do + it 'returns krb5tgs-rc4' do + hash = described_class.identify_hash('$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab') + expect(hash).to match('krb5tgs-rc4') + end + end + + describe 'identify_krb5tgs-aes128' do + it 'returns krb5tgs-aes128' do + hash = described_class.identify_hash('$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e') + expect(hash).to match('krb5tgs-aes128') + end + end + + describe 'identify_krb5tgs-aes256' do + it 'returns krb5tgs-aes256' do + hash = described_class.identify_hash('$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0') + expect(hash).to match('krb5tgs-aes256') + end + end + + describe 'identify_krb5asrep-rc4' do + it 'returns krb5asrep-rc4' do + hash = described_class.identify_hash('$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac') + expect(hash).to match('krb5asrep-rc4') + end + end + describe 'identify_vnc' do it 'returns vnc' do hash = described_class.identify_hash('*00112233445566778899aabbccddeeff*6feb3cb1f07b66151656b5832341f223') From f28a84abeec0a5fea2454fd3af94c94a49e1da76 Mon Sep 17 00:00:00 2001 From: h00die Date: Sat, 17 Jan 2026 20:05:50 -0500 Subject: [PATCH 02/12] kerberoast hash types added for cracking --- .../Hashes-and-Password-Cracking.md | 3 ++- .../framework/password_crackers/hashcat/formatter.rb | 8 +++++--- modules/auxiliary/analyze/crack_windows.rb | 11 ++++++++++- spec/lib/metasploit/framework/hashes/identify_spec.rb | 7 +++++++ 4 files changed, 24 insertions(+), 5 deletions(-) diff --git a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md index 219f546fe9398..50d0d1c928a3a 100644 --- a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md +++ b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md @@ -156,7 +156,7 @@ creds add user:krb5tgs-rc4 hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql0 creds add user:krb5tgs-aes128 hash:$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128 creds add user:krb5tgs-aes256 hash:$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256 creds add user:krb5asrep-rc4 hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4 -creds add user:timeroast hash: jtr:timeroast +creds add user:timeroast hash:$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast # sql creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05 creds add user:mssql_foo hash:0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254 jtr:mssql @@ -250,3 +250,4 @@ Only hashes which were found in Metasploit were added to the hash id library, an 1. Update this Wiki 1. Add the JTR to hashcat conversion 1. Add example hash(es) +1. Update [tools/dev/hash_cracker_validator.rb](https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/hash_cracker_validator.rb) to help validate hashes can crack diff --git a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb index 3a08fcf06eb27..ed21733846862 100644 --- a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb +++ b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb @@ -131,10 +131,12 @@ def add_equals_to_base64(str) # https://hashcat.net/forum/thread-8833.html # while we can do the transformation, we'd have to throw extra flags at hashcat which aren't currently written into the lib for automation nil - when /^krb5$/ - return "#{cred.id}:#{cred.private.data}" + # when /^krb5$/ + # return "#{cred.id}:#{cred.private.data}" when /^(krb5.|timeroast$)/ - return cred.private.data + # krb5tgs-rc4, krb5tgs-aes128, krb5tgs-aes256, krb5asrep-rc4, timeroast + ## hash-mode: 13100 19600 19700 18200 31300 + return "#{cred.id}:#{cred.private.data}" end end nil diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index df9161cc988a6..314715bf8dfbc 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -20,6 +20,7 @@ def initialize MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 is format 5600 in hashcat. + krb5tgs (Kerberos Tickets) is format 13100 in hashcat. ), 'Author' => [ 'theLightCosine', @@ -50,6 +51,7 @@ def initialize OptBool.new('MSCASH', [false, 'Crack M$ CASH hashes (1 and 2)', true]), OptBool.new('NETNTLM', [false, 'Crack NetNTLM', true]), OptBool.new('NETNTLMV2', [false, 'Crack NetNTLMv2', true]), + OptBool.new('KERBEROS', [false, 'Crack krb5 related hashes', true]), OptBool.new('INCREMENTAL', [false, 'Run in incremental mode', true]), OptBool.new('WORDLIST', [false, 'Run in wordlist mode', true]), OptBool.new('NORMAL', [false, 'Run in normal mode (John the Ripper only)', true]) @@ -113,7 +115,7 @@ def check_results(passwords, results, hash_type, method) cred['username'] = fields.shift cred['core_id'] = fields.pop case hash_type - when 'mscash', 'mscash2', 'netntlm', 'netntlmv2' + when 'mscash', 'mscash2', 'netntlm', 'netntlmv2', 'krb5tgs' cred['password'] = fields.shift when 'lm', 'nt' # If we don't have an expected minimum number of fields, this is probably not a NTLM hash @@ -148,6 +150,8 @@ def check_results(passwords, results, hash_type, method) if ['netntlm', 'netntlmv2'].include? hash_type # we could grab the username here, but no need since we grab it later based on core_id, which is safer 6.times { fields.shift } # Get rid of a bunch of extra fields + elsif ['krb5tgs-rc4', 'krb5asrep-rc4'].include? hash_type + 2.times { fields.shift } # Get rid of extra hash fields else cred['hash'] = fields.shift end @@ -182,6 +186,11 @@ def run hash_types_to_crack << 'mscash2' if datastore['MSCASH'] hash_types_to_crack << 'netntlm' if datastore['NETNTLM'] hash_types_to_crack << 'netntlmv2' if datastore['NETNTLMV2'] + hash_types_to_crack << 'krb5tgs-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5tgs-aes128' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5tgs-aes256' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5asrep-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'timeroast' if datastore['KERBEROS'] jobs_to_do = [] diff --git a/spec/lib/metasploit/framework/hashes/identify_spec.rb b/spec/lib/metasploit/framework/hashes/identify_spec.rb index 448650f24c9d0..0c610926ed036 100644 --- a/spec/lib/metasploit/framework/hashes/identify_spec.rb +++ b/spec/lib/metasploit/framework/hashes/identify_spec.rb @@ -327,6 +327,13 @@ end end + describe 'identify_timeroast' do + it 'returns timeroast' do + hash = described_class.identify_hash('$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380') + expect(hash).to match('timeroast') + end + end + describe 'identify_vnc' do it 'returns vnc' do hash = described_class.identify_hash('*00112233445566778899aabbccddeeff*6feb3cb1f07b66151656b5832341f223') From 10076484490dc333ccd1e16a5988696e8ba324d2 Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 18 Jan 2026 08:32:18 -0500 Subject: [PATCH 03/12] finish fixing up hash_cracker_validator --- modules/auxiliary/analyze/crack_windows.rb | 8 ++++++-- tools/dev/hash_cracker_validator.rb | 13 +++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index 314715bf8dfbc..b1a991141b4e0 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -20,7 +20,11 @@ def initialize MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 is format 5600 in hashcat. - krb5tgs (Kerberos Tickets) is format 13100 in hashcat. + krb5tgs-rc4 is format 13100 in hashcat. + krb5tgs-aes128 is format 19600 in hashcat. + krb5tgs-aes256 is format 19700 in hashcat. + krb5asrep-rc4 is format 18200 in hashcat. + timeroast is format 31300 in hashcat. ), 'Author' => [ 'theLightCosine', @@ -51,7 +55,7 @@ def initialize OptBool.new('MSCASH', [false, 'Crack M$ CASH hashes (1 and 2)', true]), OptBool.new('NETNTLM', [false, 'Crack NetNTLM', true]), OptBool.new('NETNTLMV2', [false, 'Crack NetNTLMv2', true]), - OptBool.new('KERBEROS', [false, 'Crack krb5 related hashes', true]), + OptBool.new('KERBEROS', [false, 'Crack krb5/timeroast related hashes', true]), OptBool.new('INCREMENTAL', [false, 'Run in incremental mode', true]), OptBool.new('WORDLIST', [false, 'Run in wordlist mode', true]), OptBool.new('NORMAL', [false, 'Run in normal mode (John the Ripper only)', true]) diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index 87f376a2b398e..3ae1bb05bd897 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -191,6 +191,19 @@ def windows_hashes_and_regex_hashcat_compat cred_temp, regex_temp = windows_hashes_and_regex_john_compat creds_command << cred_temp creds_expected_output_regex += regex_temp +<<<<<<< HEAD +======= + creds_command << ' creds add user:krb5tgs-rc4 hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4;' + creds_expected_output_regex << %r{krb5tgs-rc4\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-rc4\s+Password1!$} + creds_command << ' creds add user:krb5tgs-aes128 hash:\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128;' + creds_expected_output_regex << /krb5tgs-aes128\s+\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958 \(TRUNCATED\)\s+ Nonreplayable hash\s+krb5tgs-aes128\s+hashcat$/ + creds_command << ' creds add user:krb5tgs-aes256 hash:\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256;' + creds_expected_output_regex << /krb5tgs-aes256\s+\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-aes256\s+hashcat$/ + creds_command << ' creds add user:krb5asrep-rc4 hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4;' + creds_expected_output_regex << /krb5asrep-rc4\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep-rc4\s+hashcat$/ + creds_command << ' creds add user:timeroast hash:\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast;' + creds_expected_output_regex << /timeroast\s+\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$9077336975368113429621409555671085 \(TRUNCATED\)\s+Nonreplayable hash\s+timeroast\s+hashcat$/ +>>>>>>> 5e4c422db9 (finish fixing up hash_cracker_validator) return creds_command, creds_expected_output_regex end From 8e3580b045dd02a24f1065f61e929feb7e4a4d1c Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 28 Jan 2026 09:47:57 -0500 Subject: [PATCH 04/12] take incoming --- .../Hashes-and-Password-Cracking.md | 22 ++++++++--------- .../framework/password_crackers/cracker.rb | 4 ++-- .../password_crackers/hashcat/formatter.rb | 4 ++-- modules/auxiliary/analyze/crack_windows.rb | 24 ++++++++++++------- .../framework/hashes/identify_spec.rb | 20 +++++++++++----- tools/dev/hash_cracker_validator.rb | 9 +++++-- 6 files changed, 51 insertions(+), 32 deletions(-) diff --git a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md index 50d0d1c928a3a..a310e576d0d24 100644 --- a/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md +++ b/docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md @@ -71,10 +71,10 @@ This section will cover the differences between the two crackers. This is not a | blowfish | bcrypt | 3200 | lanman | lm | 3000 | NTLM | nt | 1000 -| krb5tgs-rc4 | krb5tgs | 13100 +| krb5tgs | krb5tgs | 13100 | krb5tgs-aes128 | | 19600 | krb5tgs-aes256 | | 19700 -| krb5asrep-rc4 | | 18200 +| krb5asrep | krb5asrep | 18200 | timeroast | | 31300 | mssql (05) | mssql | 131 | mssql12 | mssql12 | 1731 @@ -152,10 +152,10 @@ creds add user:u4-netntlm hash:u4-netntlm::kNS:338d08f8e26de93300000000000000000 creds add user:admin hash:admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030 jtr:netntlmv2 creds add user:mscash-test1 hash:M$test1#64cd29e36a8431a2b111378564a10631 jtr:mscash creds add user:mscash2-hashcat hash:$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2 -creds add user:krb5tgs-rc4 hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4 +creds add user:krb5tgs hash:$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs creds add user:krb5tgs-aes128 hash:$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128 creds add user:krb5tgs-aes256 hash:$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256 -creds add user:krb5asrep-rc4 hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4 +creds add user:krb5asrep hash:$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep creds add user:timeroast hash:$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast # sql creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05 @@ -194,8 +194,8 @@ creds add user:admin hash:'$pbkdf2-sha256$260000$Q1hzYjU5dFNMWm05QUJCTg$s.vmjGlI This data breaks down to the following table: -| **Hash Type** | **Username** | **Hash** | **Password** | **jtr format** | **Modules which dump this info** | **Modules which crack this** | -|:------------------------------------:|:------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------:|:--------------------:|:------------------------------------------------:|:---------------------------------------------------------:| +| **Hash Type** | **Username** | **Hash** | **Password** | **jtr format** | **Modules which dump this info** | **Modules which crack this** | +|:------------------------------------:|:------------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------:|:--------------------:|:------------------------------------------------:|:---------------------------------------------------------:| | DES | des_password | `rEK1ecacw.7.c` | password | des | post/aix/gather/hashdump | auxiliary/analyze/crack_aix auxiliary/analyze/crack_linux | | MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | | BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | post/linux/gather/hashdump | auxiliary/analyze/crack_linux | @@ -208,11 +208,11 @@ This data breaks down to the following table: | NetNTLMv2 | admin | `admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030` | hashcat | netntlmv2 |   | auxiliary/analyze/crack_windows | | MSCash | mscash-test1 | `M$test1#64cd29e36a8431a2b111378564a10631` | test1 | mscash |   | auxiliary/analyze/crack_windows | | MSCash2 | mscash2-hashcat | `$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f` | hashcat | mscash2 |   | auxiliary/analyze/crack_windows | -| Kerberos (Kerberoast) | krb5tgs-rc4 | `$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab` | Password1! | krb5tgs-rc4 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | -| | krb5tgs-aes128 | `$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e` | hashcat | krb5tgs-aes128 | | auxiliary/analyze/crack_windows | -| | krb5tgs-aes256 | `$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0` | hashcat | krb5tgs-aes256 | | auxiliary/analyze/crack_windows | -| | krb5asrep-rc4 | `$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac` | hashcat | krb5asrep-rc4 | | auxiliary/analyze/crack_windows | -| | timeroast | | | timeroast | | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs | `$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab` | Password1! | krb5tgs | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs-aes128 | `$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e` | hashcat | krb5tgs-aes128 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| Kerberos (Kerberoast) | krb5tgs-aes256 | `$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0` | hashcat | krb5tgs-aes256 | auxiliary/gather/kerberoast | auxiliary/analyze/crack_windows | +| | krb5asrep | `$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac` | hashcat | krb5asrep-rc4 | auxiliary/gather/asrep | auxiliary/analyze/crack_windows | +| NTP Timeroast | timeroast | `$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380` | hashcat | timeroast | auxiliary/scanner/ntp/timeroast | auxiliary/analyze/crack_windows | | MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | | MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | | MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password1! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases | diff --git a/lib/metasploit/framework/password_crackers/cracker.rb b/lib/metasploit/framework/password_crackers/cracker.rb index bd9c60cf21f77..6cc77ae928240 100644 --- a/lib/metasploit/framework/password_crackers/cracker.rb +++ b/lib/metasploit/framework/password_crackers/cracker.rb @@ -157,13 +157,13 @@ def jtr_format_to_hashcat_format(format) '5500' when 'netntlmv2' '5600' - when 'krb5tgs-rc4' + when 'krb5tgs' '13100' when 'krb5tgs-aes128' '19600' when 'krb5tgs-aes256' '19700' - when 'krb5asrep-rc4' + when 'krb5asrep' '18200' when 'timeroast' '31300' diff --git a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb index ed21733846862..1520023e4b083 100644 --- a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb +++ b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb @@ -134,8 +134,8 @@ def add_equals_to_base64(str) # when /^krb5$/ # return "#{cred.id}:#{cred.private.data}" when /^(krb5.|timeroast$)/ - # krb5tgs-rc4, krb5tgs-aes128, krb5tgs-aes256, krb5asrep-rc4, timeroast - ## hash-mode: 13100 19600 19700 18200 31300 + # krb5tgs, krb5tgs-aes128, krb5tgs-aes256, krb5asrep, timeroast + ## hash-mode: 13100 19600 19700 18200 31300 return "#{cred.id}:#{cred.private.data}" end end diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index b1a991141b4e0..0a93263043250 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -20,10 +20,10 @@ def initialize MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 is format 5600 in hashcat. - krb5tgs-rc4 is format 13100 in hashcat. + krb5tgs is format 13100 in hashcat. krb5tgs-aes128 is format 19600 in hashcat. krb5tgs-aes256 is format 19700 in hashcat. - krb5asrep-rc4 is format 18200 in hashcat. + krb5asrep is format 18200 in hashcat. timeroast is format 31300 in hashcat. ), 'Author' => [ @@ -114,17 +114,23 @@ def check_results(passwords, results, hash_type, method) cred = { 'hash_type' => hash_type, 'method' => method } if @cracker_type == 'john' # If we don't have an expected minimum number of fields, this is probably not a hash line - next unless fields.count > 2 + next unless fields.count >= 2 # krb5asrep and similar kerberoast fields have 2 fields only - cred['username'] = fields.shift - cred['core_id'] = fields.pop case hash_type - when 'mscash', 'mscash2', 'netntlm', 'netntlmv2', 'krb5tgs' + when 'krb5asrep' + cred['core_id'] = fields.shift + cred['password'] = fields.pop + when 'mscash', 'mscash2', 'netntlm', 'netntlmv2' + cred['username'] = fields.shift + cred['core_id'] = fields.pop cred['password'] = fields.shift when 'lm', 'nt' # If we don't have an expected minimum number of fields, this is probably not a NTLM hash next unless fields.count >= 6 + cred['username'] = fields.shift + cred['core_id'] = fields.pop + 2.times { fields.pop } # Get rid of extra : nt_hash = fields.pop fields.pop @@ -154,7 +160,7 @@ def check_results(passwords, results, hash_type, method) if ['netntlm', 'netntlmv2'].include? hash_type # we could grab the username here, but no need since we grab it later based on core_id, which is safer 6.times { fields.shift } # Get rid of a bunch of extra fields - elsif ['krb5tgs-rc4', 'krb5asrep-rc4'].include? hash_type + elsif ['krb5tgs', 'krb5asrep'].include? hash_type 2.times { fields.shift } # Get rid of extra hash fields else cred['hash'] = fields.shift @@ -190,10 +196,10 @@ def run hash_types_to_crack << 'mscash2' if datastore['MSCASH'] hash_types_to_crack << 'netntlm' if datastore['NETNTLM'] hash_types_to_crack << 'netntlmv2' if datastore['NETNTLMV2'] - hash_types_to_crack << 'krb5tgs-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5tgs' if datastore['KERBEROS'] hash_types_to_crack << 'krb5tgs-aes128' if datastore['KERBEROS'] hash_types_to_crack << 'krb5tgs-aes256' if datastore['KERBEROS'] - hash_types_to_crack << 'krb5asrep-rc4' if datastore['KERBEROS'] + hash_types_to_crack << 'krb5asrep' if datastore['KERBEROS'] hash_types_to_crack << 'timeroast' if datastore['KERBEROS'] jobs_to_do = [] diff --git a/spec/lib/metasploit/framework/hashes/identify_spec.rb b/spec/lib/metasploit/framework/hashes/identify_spec.rb index 0c610926ed036..4719710f77f64 100644 --- a/spec/lib/metasploit/framework/hashes/identify_spec.rb +++ b/spec/lib/metasploit/framework/hashes/identify_spec.rb @@ -299,10 +299,18 @@ end end - describe 'identify_krb5tgs-rc4' do - it 'returns krb5tgs-rc4' do + describe 'identify_krb5tgs_hashcat_format' do + it 'returns krb5tgs' do hash = described_class.identify_hash('$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local:1433*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab') - expect(hash).to match('krb5tgs-rc4') + expect(hash).to match('krb5tgs') + end + end + + describe 'identify_krb5tgs_john_format' do + it 'returns krb5tgs' do + # https://github.com/openwall/john/issues/5944#issuecomment-3772129757 + hash = described_class.identify_hash('$krb5tgs$23$*svc_test$MSFLAB.LOCAL$MSSQLSvc/sql01.msflab.local*$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab') + expect(hash).to match('krb5tgs') end end @@ -320,10 +328,10 @@ end end - describe 'identify_krb5asrep-rc4' do - it 'returns krb5asrep-rc4' do + describe 'identify_krb5asrep' do + it 'returns krb5asrep' do hash = described_class.identify_hash('$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac') - expect(hash).to match('krb5asrep-rc4') + expect(hash).to match('krb5asrep') end end diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index 3ae1bb05bd897..d425dfc640e32 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -182,6 +182,8 @@ def windows_hashes_and_regex_john_compat creds_expected_output_regex << /mscash-test1\s+M\$test1\#64cd29e36a8431a2b111378564a10631\s+Nonreplayable hash\s+mscash\s+test1$/ creds_command << ' creds add user:mscash2-hashcat hash:\$DCC2\$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2;' creds_expected_output_regex << /mscash2-hashcat\s+\$DCC2\$10240\#tom\#e4e938d12fe5974dc42a90120bd9c90f\s+Nonreplayable hash\s+mscash2\s+hashcat$/ + creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' + creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ return creds_command, creds_expected_output_regex end @@ -192,15 +194,18 @@ def windows_hashes_and_regex_hashcat_compat creds_command << cred_temp creds_expected_output_regex += regex_temp <<<<<<< HEAD +<<<<<<< HEAD ======= creds_command << ' creds add user:krb5tgs-rc4 hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4;' creds_expected_output_regex << %r{krb5tgs-rc4\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-rc4\s+Password1!$} +======= + creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' + creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} +>>>>>>> 89d15d6401 (john fixes) creds_command << ' creds add user:krb5tgs-aes128 hash:\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128;' creds_expected_output_regex << /krb5tgs-aes128\s+\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958 \(TRUNCATED\)\s+ Nonreplayable hash\s+krb5tgs-aes128\s+hashcat$/ creds_command << ' creds add user:krb5tgs-aes256 hash:\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256;' creds_expected_output_regex << /krb5tgs-aes256\s+\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-aes256\s+hashcat$/ - creds_command << ' creds add user:krb5asrep-rc4 hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep-rc4;' - creds_expected_output_regex << /krb5asrep-rc4\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep-rc4\s+hashcat$/ creds_command << ' creds add user:timeroast hash:\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast;' creds_expected_output_regex << /timeroast\s+\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$9077336975368113429621409555671085 \(TRUNCATED\)\s+Nonreplayable hash\s+timeroast\s+hashcat$/ >>>>>>> 5e4c422db9 (finish fixing up hash_cracker_validator) From 75f28b539f813a22f0bfbb8c131560b91fcd9ff3 Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 26 Jan 2026 08:55:46 -0500 Subject: [PATCH 05/12] kerberoast cracking updates --- documentation/modules/auxiliary/gather/kerberoast.md | 2 +- lib/metasploit/framework/hashes.rb | 11 +++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/documentation/modules/auxiliary/gather/kerberoast.md b/documentation/modules/auxiliary/gather/kerberoast.md index ded67b551a4ec..16a804f46632b 100644 --- a/documentation/modules/auxiliary/gather/kerberoast.md +++ b/documentation/modules/auxiliary/gather/kerberoast.md @@ -66,7 +66,7 @@ $krb5tgs$23$*kerber.roastable$MSF.LOCAL$http/abc2.msf.local*$d335dc07b2c018de2a1 $krb5tgs$17$low.admin$MSF.LOCAL$*http/abc.msf.local*$a1c7c1c1e31e36cdb0721928$b69b48... [!] NOTE: Multiple encryption types returned - will require separate cracking runs for each type. [*] To obtain the crackable values for a praticular type, run `creds`: -[*] creds -t krb5tgs-rc4 -O 20.248.208.9 -o +[*] creds -t krb5tgs -O 20.248.208.9 -o [*] creds -t krb5tgs-aes128 -O 20.248.208.9 -o [*] Auxiliary module execution completed ``` diff --git a/lib/metasploit/framework/hashes.rb b/lib/metasploit/framework/hashes.rb index bb92d28a2c437..6eaeb5d3fc6c0 100644 --- a/lib/metasploit/framework/hashes.rb +++ b/lib/metasploit/framework/hashes.rb @@ -8,7 +8,6 @@ module Framework # http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats # https://openwall.info/wiki/john/sample-hashes # QNX formats -> https://moar.so/blog/qnx-password-hash-formats.html - # rubocop:disable Metrics/ModuleLength module Hashes JTR_NTLMV1 = 'netntlm'.freeze JTR_NTLMV2 = 'netntlmv2'.freeze @@ -67,9 +66,9 @@ def self.identify_hash(hash) return 'nt' when hash.length == 65 && hash =~ /^[\da-fA-F]{32}:[\da-fA-F]{32}$/ return 'lm' - when hash =~ /^[^\\\/:*?"<>|]{1,20}[:]{2,3}([^\\\/:*?"<>|]{1,20})?:[a-f0-9]{48}:[a-f0-9]{48}:[a-f0-9]{16}$/ + when hash =~ %r{^[^\\/:*?"<>|]{1,20}:{2,3}([^\\/:*?"<>|]{1,20})?:[a-f0-9]{48}:[a-f0-9]{48}:[a-f0-9]{16}$} return 'netntlm' - when hash =~ /^([^\\\/:*?"<>|]{1,20}\\)?[^\\\/:*?"<>|]{1,20}[:]{2,3}([^\\\/:*?"<>|]{1,20}:)?[^\\\/:*?"<>|]{1,20}:[a-f0-9]{32}:[a-f0-9]+$/ + when hash =~ %r{^([^\\/:*?"<>|]{1,20}\\)?[^\\/:*?"<>|]{1,20}:{2,3}([^\\/:*?"<>|]{1,20}:)?[^\\/:*?"<>|]{1,20}:[a-f0-9]{32}:[a-f0-9]+$} return 'netntlmv2' # OSX when hash.start_with?('$ml$') && hash.split('$').last.length == 256 @@ -124,18 +123,18 @@ def self.identify_hash(hash) when hash =~ /^\*?[\da-fA-F]{32}\*[\da-fA-F]{32}$/ # we accept the beginning star as optional return 'vnc' - when hash =~ /^\$pbkdf2-sha256\$[0-9]+\$[a-z0-9\/.]+\$[a-z0-9\/.]{43}$/i + when hash =~ %r{^\$pbkdf2-sha256\$[0-9]+\$[a-z0-9/.]+\$[a-z0-9/.]{43}$}i return 'pbkdf2-sha256' when hash =~ /^\$sntp-ms\$[\da-fA-F]{32}\$[\da-fA-F]{96}$/ return 'timeroast' when hash =~ /^\$krb5tgs\$23\$\*.+\$[\da-fA-F]{32}\$[\da-fA-F]+$/ - return 'krb5tgs-rc4' + return 'krb5tgs' when hash =~ /^\$krb5tgs\$18\$.+\$[\da-fA-F]{24}\$[\da-fA-F]+$/ return 'krb5tgs-aes256' when hash =~ /^\$krb5tgs\$17\$.+\$[\da-fA-F]{24}\$[\da-fA-F]+$/ return 'krb5tgs-aes128' when hash =~ /^\$krb5asrep\$23\$[^:]+:[\da-fA-F]{32}\$[\da-fA-F]+$/ - return 'krb5asrep-rc4' + return 'krb5asrep' # hashcat is krb5asrep-rc4, but we use john format end '' end From c54d005d2c3013e22a2e5e49ef738954a098f63d Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 28 Jan 2026 09:56:22 -0500 Subject: [PATCH 06/12] remove bad rebase items --- tools/dev/hash_cracker_validator.rb | 8 -------- 1 file changed, 8 deletions(-) diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index d425dfc640e32..e6490e0273d0d 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -193,22 +193,14 @@ def windows_hashes_and_regex_hashcat_compat cred_temp, regex_temp = windows_hashes_and_regex_john_compat creds_command << cred_temp creds_expected_output_regex += regex_temp -<<<<<<< HEAD -<<<<<<< HEAD -======= - creds_command << ' creds add user:krb5tgs-rc4 hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs-rc4;' - creds_expected_output_regex << %r{krb5tgs-rc4\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-rc4\s+Password1!$} -======= creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} ->>>>>>> 89d15d6401 (john fixes) creds_command << ' creds add user:krb5tgs-aes128 hash:\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128;' creds_expected_output_regex << /krb5tgs-aes128\s+\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958 \(TRUNCATED\)\s+ Nonreplayable hash\s+krb5tgs-aes128\s+hashcat$/ creds_command << ' creds add user:krb5tgs-aes256 hash:\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256;' creds_expected_output_regex << /krb5tgs-aes256\s+\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs-aes256\s+hashcat$/ creds_command << ' creds add user:timeroast hash:\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380 jtr:timeroast;' creds_expected_output_regex << /timeroast\s+\$sntp-ms\$cfc7023381cf6bb474cdcbeb0a67bdb3\$9077336975368113429621409555671085 \(TRUNCATED\)\s+Nonreplayable hash\s+timeroast\s+hashcat$/ ->>>>>>> 5e4c422db9 (finish fixing up hash_cracker_validator) return creds_command, creds_expected_output_regex end From 55934bb8ebd0f45a01e24e7a3abac7a8644bd03a Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 1 Feb 2026 17:48:14 -0500 Subject: [PATCH 07/12] hash_crack_validator rewite and john krb5tgs working --- .../password_crackers/jtr/formatter.rb | 5 +- modules/auxiliary/analyze/crack_windows.rb | 2 +- tools/dev/hash_cracker_validator.rb | 723 ++++++------------ 3 files changed, 244 insertions(+), 486 deletions(-) diff --git a/lib/metasploit/framework/password_crackers/jtr/formatter.rb b/lib/metasploit/framework/password_crackers/jtr/formatter.rb index 7c98acf8efdf6..4fc2d7d696a1e 100644 --- a/lib/metasploit/framework/password_crackers/jtr/formatter.rb +++ b/lib/metasploit/framework/password_crackers/jtr/formatter.rb @@ -97,7 +97,10 @@ def self.params_to_jtr(username, private_data, private_type, format: nil, db_id: # for this we overload the username field with the db_id so we can find it in the db easier later # https://github.com/openwall/john/issues/5944 private_data = private_data.split('$') - private_data[5] = private_data[5].split(':').first + # remove port if there is one + if private_data[5].include?(':') + private_data[5] = private_data[5].split(':').first + '*' + end private_data = private_data.join('$') return "#{db_id}:#{private_data}" when /^(krb5.|timeroast$)/ diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index 0a93263043250..b2cecbdc17048 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -117,7 +117,7 @@ def check_results(passwords, results, hash_type, method) next unless fields.count >= 2 # krb5asrep and similar kerberoast fields have 2 fields only case hash_type - when 'krb5asrep' + when 'krb5asrep', 'krb5tgs' cred['core_id'] = fields.shift cred['password'] = fields.pop when 'mscash', 'mscash2', 'netntlm', 'netntlmv2' diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index e6490e0273d0d..3d22ebc75be94 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -56,6 +56,9 @@ end end.parse! +# expose options to methods +$options = options + # colors and puts templates from msftidy.rb class String @@ -184,6 +187,8 @@ def windows_hashes_and_regex_john_compat creds_expected_output_regex << /mscash2-hashcat\s+\$DCC2\$10240\#tom\#e4e938d12fe5974dc42a90120bd9c90f\s+Nonreplayable hash\s+mscash2\s+hashcat$/ creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ + creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' + creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB\.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} return creds_command, creds_expected_output_regex end @@ -273,6 +278,49 @@ def run_msfconsole(command, expected_output_regexes) end end +# return the common setg base settings string +def base_settings(wordlist: true) + s = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; ' + s << 'setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; ' + s << (wordlist ? 'setg WORDLIST true; ' : 'setg WORDLIST false; ') + s << 'setg verbose true;' + s +end + +# Run a test section using the provided creds proc and analyzer. +# creds_proc should return [creds_command, creds_expected_output_regex] +def run_section(desc:, creds_proc:, analyzer:, use_wordlist: true, action: nil, pot_path: nil, skip_base_settings: false) + info desc + tempfile = nil + begin + tempfile = Tempfile.new('john_pot') unless pot_path + creds_expected_output_regex = [] + creds_command = skip_base_settings ? '' : base_settings(wordlist: use_wordlist) + + cred_temp, regex_temp = creds_proc.call + creds_command << cred_temp + creds_expected_output_regex += regex_temp + + creds_command << " use #{analyzer};" + creds_command << " set CUSTOM_WORDLIST #{$wordlist.path};" if use_wordlist + creds_command << " set POT #{pot_path || tempfile.path};" + creds_command << " set action #{action};" if action + creds_command << ' run; creds -d; exit;' + + info "Run Command: #{creds_command}" if $options[:verbose] + success = run_msfconsole(creds_command, creds_expected_output_regex) + unless success + error 'Credential verification failed. Exiting.' + exit 1 + end + ensure + if tempfile + tempfile.close! + tempfile.unlink + end + end +end + if options[:test] == 'all' || options[:test].include?(1) info '[1/24] Checking Metasploit database connection...' db_status_command = 'db_status; exit' @@ -288,555 +336,262 @@ def run_msfconsole(command, expected_output_regexes) File.open(wordlist, 'w') { |file| file.write("password\nhashcat\ntest1\ntoto\nfoo\nPassword1!\nprobe\ntere\na\nTHALES\nepsilon\n1234\nTestPass123#\npasswor\nd\n") } info "Wordlist file created at: #{wordlist.path}" +# expose the wordlist to methods (methods don't capture local variables) +$wordlist = wordlist + +# Create a john pot tempfile used by the pot-mode tests +pot_file = Tempfile.new('john_pot') +info "Pot file created at: #{pot_file.path}" + if options[:test] == 'all' || options[:test].include?(2) - info '[2/24] Running *nix hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[2/24] Running *nix hashes in john wordlist mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(3) - info '[3/24] Running windows hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[3/24] Running windows hashes in john wordlist mode...', + creds_proc: method(:windows_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(4) - info '[4/24] Running sql hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[4/24] Running sql hashes in john wordlist mode...', + creds_proc: method(:sql_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(5) - info '[5/24] Running osx hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[5/24] Running osx hashes in john wordlist mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(6) - info '[6/24] Running webapp hashes in john wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[6/24] Running webapp hashes in john wordlist mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: true + ) end if options[:test] == 'all' || options[:test].include?(7) - info '[7/24] Running *nix hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[7/24] Running *nix hashes in hashcat wordlist mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(8) - info '[8/24] Running windows hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[8/24] Running windows hashes in hashcat wordlist mode...', + creds_proc: method(:windows_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(9) - info '[9/24] Running sql hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[9/24] Running sql hashes in hashcat wordlist mode...', + creds_proc: method(:sql_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(10) - info '[10/24] Running mobile hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = mobile_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_mobile;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[10/24] Running mobile hashes in hashcat wordlist mode...', + creds_proc: method(:mobile_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_mobile', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(11) - info '[11/24] Running osx hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink + run_section( + desc: '[11/24] Running osx hashes in hashcat wordlist mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(12) - info '[12/24] Running webapp hashes in hashcat wordlist mode...' - tempfile = Tempfile.new('john_pot') - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST true; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{tempfile.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - tempfile.close! - tempfile.unlink - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - exit 1 - end - tempfile.close! - tempfile.unlink -end - -wordlist.close! -wordlist.unlink - -pot_file = Tempfile.new('john_pot') -File.open(pot_file, 'w') { |file| file.write("$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/:password\nrEK1ecacw.7.c:password\n_J9..K0AyUubDrfOgO4s:password\n$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe:password\n$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5:password\n$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1:password\n$LM$4a3b108f3fa6cb6d:D\n$LM$e52cac67419a9a22:PASSWOR\n$NT$8846f7eaee8fb117ad06bdd830b7586c:password\nM$test1#64cd29e36a8431a2b111378564a10631:test1\n$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f:hashcat\n$NETNTLM$cb8086049ec4736c338d08f8e26de933$9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:hashcat\n$NETNTLMv2$ADMINN46iSNekpT$08ca45b7d7ea58ee$88dcbe4446168966a153a0064958dac6$5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat\n0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254:FOO\n0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908:toto\n0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16:Password1!\n445ff82636a7ba59:probe\n*5AD8F88516BD021DD43F171E2C785C69F8E54ADB:tere\nO$SIMON#4f8bc1809cb2af77:A\nO$SYSTEM#9eedfa0ad26c6d52:THALES\n9860a48ca459d054f3fef0f8518cf6872923dae2:81fcb23bcadd6c5:1234\nd1b19a90b87fc10c304e657f37162445dae27d16:a006983800cc3dd1:1234\n1c0a0fdb673fba36beaeb078322c7393:81fcb23bcadd6c5:1234\n1430823483D07626EF8BE3FDA2FF056D0DFD818DBFE47683:hashcat\n$LION$648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d:hashcat\n$pbkdf2-hmac-sha512$35460.93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05.752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222:hashcat\n$pbkdf2-hmac-sha1$10000$37323237333437363735323036323731$d0c38acef03f149b4b37c5a8319feeefcbd34912127ba96f3dfa5c22f49bbc1a:hashcat\n$H$984478476IagS59wHZvyQMArzfx58u.:hashcat\n$P$984478476IagS59wHZvyQMArzfx58u.:hashcat\n$B$56668501$0ce106caa70af57fd525aeaf80ef2898:hashcat\ne52cac67419a9a22:PASSWOR\n4a3b108f3fa6cb6d:D\n8846f7eaee8fb117ad06bdd830b7586c:password\n64cd29e36a8431a2b111378564a10631:test1:test1\nu4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c:hashcat\nADMIN::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat\n5ad8f88516bd021dd43f171e2c785c69f8e54adb:tere\n648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d:hashcat\n$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222:hashcat\n{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa:hashcat\n") } -info "john.pot file created at: #{pot_file.path}" - -if options[:test] == 'all' || options[:test].include?(13) - info '[13/24] Running *nix hashes in john pot mode...' - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[12/24] Running webapp hashes in hashcat wordlist mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: true, + action: 'hashcat' + ) end if options[:test] == 'all' || options[:test].include?(14) - info '[14/24] Running windows hashes in john pot mode...' + run_section( + desc: '[14/24] Running windows hashes in john pot mode...', + creds_proc: method(:windows_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: false, + pot_path: pot_file.path + ) +end - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end +if options[:test] == 'all' || options[:test].include?(13) + run_section( + desc: '[13/24] Running *nix hashes in john pot mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(15) - info '[15/24] Running sql hashes in john pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set CUSTOM_WORDLIST #{wordlist.path};" - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[15/24] Running sql hashes in john pot mode...', + creds_proc: method(:sql_hashes_and_regex_john_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(16) - info '[16/24] Running osx hashes in john pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[16/24] Running osx hashes in john pot mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(17) - info '[17/24] Running webapp hashes in john pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[17/24] Running webapp hashes in john pot mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: false, + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(18) - info '[18/24] Running *nix hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_linux;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[18/24] Running *nix hashes in hashcat pot mode...', + creds_proc: method(:nix_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_linux', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(19) - info '[19/24] Running windows hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = windows_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_windows;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[19/24] Running windows hashes in hashcat pot mode...', + creds_proc: method(:windows_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_windows', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(20) - info '[20/24] Running sql hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = sql_hashes_and_regex_hashcat_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - - creds_command << ' use auxiliary/analyze/crack_databases;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[20/24] Running sql hashes in hashcat pot mode...', + creds_proc: method(:sql_hashes_and_regex_hashcat_compat), + analyzer: 'auxiliary/analyze/crack_databases', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(21) - info '[21/24] Running mobile hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = mobile_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_mobile;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[21/24] Running mobile hashes in hashcat pot mode...', + creds_proc: method(:mobile_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_mobile', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(22) - info '[22/24] Running osx hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_osx;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[22/24] Running osx hashes in hashcat pot mode...', + creds_proc: method(:osx_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_osx', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(23) - info '[23/24] Running webapp hashes in hashcat pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; setg WORDLIST false; setg verbose true;' - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/crack_webapps;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' set action hashcat;' - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[23/24] Running webapp hashes in hashcat pot mode...', + creds_proc: method(:webapp_hashes_and_regex), + analyzer: 'auxiliary/analyze/crack_webapps', + use_wordlist: false, + action: 'hashcat', + pot_path: pot_file.path + ) end if options[:test] == 'all' || options[:test].include?(24) - info '[24/24] Running all hashes in john apply_pot mode...' - - creds_expected_output_regex = [] - creds_command = 'setg verbose true;' - cred_temp, regex_temp = nix_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = windows_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = sql_hashes_and_regex_john_compat - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = osx_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - cred_temp, regex_temp = webapp_hashes_and_regex - creds_command << cred_temp - creds_expected_output_regex += regex_temp - creds_command << ' use auxiliary/analyze/apply_pot;' - creds_command << " set POT #{pot_file.path};" - creds_command << ' run; creds -d; exit;' - info "Run Command: #{creds_command}" if options[:verbose] - unless run_msfconsole(creds_command, creds_expected_output_regex) - puts '-------------------------------' - error 'Credential verification failed. Exiting.' - pot_file.close! - pot_file.unlink - exit 1 - end + run_section( + desc: '[24/24] Running all hashes in john apply_pot mode...', + creds_proc: proc { + creds_command = 'setg verbose true;' + creds_expected_output_regex = [] + cred_temp, regex_temp = nix_hashes_and_regex + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = windows_hashes_and_regex_john_compat + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = sql_hashes_and_regex_john_compat + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = osx_hashes_and_regex + creds_command << cred_temp + creds_expected_output_regex += regex_temp + cred_temp, regex_temp = webapp_hashes_and_regex + creds_command << cred_temp + creds_expected_output_regex += regex_temp + [creds_command, creds_expected_output_regex] + }, + analyzer: 'auxiliary/analyze/apply_pot', + use_wordlist: false, + pot_path: pot_file.path, + skip_base_settings: true + ) end pot_file.close! From 04743e811418a65a8a5900342daa0811865a7b87 Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 11 Mar 2026 08:38:17 -0400 Subject: [PATCH 08/12] testing --- modules/auxiliary/analyze/crack_mobile.rb | 6 +----- modules/auxiliary/analyze/crack_windows.rb | 14 +++++++++----- tools/dev/hash_cracker_validator.rb | 10 ++++------ 3 files changed, 14 insertions(+), 16 deletions(-) diff --git a/modules/auxiliary/analyze/crack_mobile.rb b/modules/auxiliary/analyze/crack_mobile.rb index b908bdb22b9e4..4b57de1f819b3 100644 --- a/modules/auxiliary/analyze/crack_mobile.rb +++ b/modules/auxiliary/analyze/crack_mobile.rb @@ -86,11 +86,7 @@ def check_results(passwords, results, hash_type, method) end def run - tbl = Rex::Text::Table.new( - 'Header' => 'Cracked Hashes', - 'Indent' => 1, - 'Columns' => ['DB ID', 'Hash Type', 'Username', 'Cracked Password', 'Method'] - ) + tbl = cracker_results_table # array of hashes in jtr_format in the db, converted to an OR combined regex hash_types_to_crack = [] diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index b2cecbdc17048..f57aba3fccd2d 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -101,7 +101,9 @@ def process_cracker_results(results, cred) end end - create_cracked_credential(username: cred['username'], password: cred['password'], core_id: cred['core_id']) + puts "XXX process_cracker_results cred prior to create_cracked_credential: #{cred.inspect}" + t = create_cracked_credential(username: cred['username'], password: cred['password'], core_id: cred['core_id']) + puts "XXX create_cracked_credential returned: #{t.inspect}" results end @@ -157,16 +159,17 @@ def check_results(passwords, results, hash_type, method) cred['core_id'] = fields.shift - if ['netntlm', 'netntlmv2'].include? hash_type + case hash_type + when 'netntlm', 'netntlmv2' # we could grab the username here, but no need since we grab it later based on core_id, which is safer 6.times { fields.shift } # Get rid of a bunch of extra fields - elsif ['krb5tgs', 'krb5asrep'].include? hash_type + when 'krb5asrep' 2.times { fields.shift } # Get rid of extra hash fields - else + else # 'krb5tgs' cred['hash'] = fields.shift end - fields.pop if hash_type == 'mscash' # Get rid of username + fields.pop if ['mscash'].include? hash_type # Get rid of username cred['password'] = fields.join(':') # Anything left must be the password. This accounts for passwords with semi-colons in it next if cred['core_id'].include?("Hashfile '") && cred['core_id'].include?("' on line ") # skip error lines @@ -175,6 +178,7 @@ def check_results(passwords, results, hash_type, method) # so we can now just go grab the username from the DB cred['username'] = framework.db.creds(workspace: myworkspace, id: cred['core_id'])[0].public.username end + puts "XXX check_results function prior to process_crack_results: #{cred.inspect}" results = process_cracker_results(results, cred) end results diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index 3d22ebc75be94..677b124040eec 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -185,10 +185,10 @@ def windows_hashes_and_regex_john_compat creds_expected_output_regex << /mscash-test1\s+M\$test1\#64cd29e36a8431a2b111378564a10631\s+Nonreplayable hash\s+mscash\s+test1$/ creds_command << ' creds add user:mscash2-hashcat hash:\$DCC2\$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2;' creds_expected_output_regex << /mscash2-hashcat\s+\$DCC2\$10240\#tom\#e4e938d12fe5974dc42a90120bd9c90f\s+Nonreplayable hash\s+mscash2\s+hashcat$/ - creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' - creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ - creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' - creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB\.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} + #creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' + #creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ + creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*user\$realm\$test/spn*\$63386d22d359fe42230300d56852c9eb\$891ad31d09ab89c6b3b8c5e5de6c06a7f49fd559d7a9a3c32576c8fedf705376cea582ab5938f7fc8bc741acf05c5990741b36ef4311fe3562a41b70a4ec6ecba849905f2385bb3799d92499909658c7287c49160276bca0006c350b0db4fd387adc27c01e9e9ad0c20ed53a7e6356dee2452e35eca2a6a1d1432796fc5c19d068978df74d3d0baf35c77de12456bf1144b6a750d11f55805f5a16ece2975246e2d026dce997fba34ac8757312e9e4e6272de35e20d52fb668c5ed jtr:krb5tgs;' + creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*user\$realm\$test/spn\*\$63386d22d359fe42230300d56852c9eb\$891ad31d0\s+\(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+hashcat$} return creds_command, creds_expected_output_regex end @@ -198,8 +198,6 @@ def windows_hashes_and_regex_hashcat_compat cred_temp, regex_temp = windows_hashes_and_regex_john_compat creds_command << cred_temp creds_expected_output_regex += regex_temp - creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*svc_test\$MSFLAB.LOCAL\$MSSQLSvc\/sql01.msflab.local:1433*\$cd5188391bf0e980a2cc48fddfcdb6c9\$838309d0fe47fe1452faa663a378b37b5b69a170ee564ef4197f7f7ac918923e39dc0fe17b3beb9a963af47929d506d9d798fefb6038fe6447401cf23212a27aca5f05b8248aed48190d4b6b41405e796a960cc8c02bacb5c5e9869226e039f2581d98cd4d0defe15fd131d48a38ce95d69e28d8ae5f5fcfd371bdab8a68cd044c71a1b1cd46a0fb35eea7043bc7c3703186a9a0dcf6e8b688fdde20603de5daa7d428cf2923c0ba59a12c855ba396e080055e6d340231ba4822db632d12ba19eec436815fc28c88d8852601d58217019566c7c601ed37bb96920bbef4bf357b8e73549dbb70a5f4c53609c008e55d093b409572699b86fc8bd8cc395d6ec2de5fb2f64c56b7f6dd85ab89094883df99f3fd24db442b6da46c8998b3a5bd407fcb6fb2b65faded0b37034b54fa398d604c7030f52db4826ba09698a9a56a2f57a93f5299033cdcd641b4678926df5d8730b6b923c663fa2f9f2fa5f225a4108380f2b7bb9d75620478d1b912949a346bf19688877fcdf92231387b4c1d9ae83420abd38215802859c535205f8673125e0a559aa646663f4e41e97e5339be48972cafb501d01d3ec0f13bcc578b431b74eb285084d167d307ef5b5e2a2fa7cae7b221a6f5a0ce6a45883e6ccbdedcec7cfbc1dec3cad4b53d2db01750e087906747f3e5ed6d3e776a8844f578ff2072325d3d8122fd08342a18d5a637275aa1c534a78e9f798eb61dc2ca4a3cab0ea5b20bf67739763298cee85cc51443ba4faaf069593639fd474c69f31a5f6f29eb1ef20692091eb9eed5aa729dc84af1dde99ccbc978f2334fb1906d224101c425e088d98608ea05b7d4dccdee207d5a3e672829f35e3be751e2b395002619a6e0863e41b10efc321f2ae57fed86b5ed90b5a641e6d3488335ea4e8d8bea397ce35fa0113cf05b4c0c38ee0140d4be3bd490b461dc4fb41b4fc2c50bee160d379934f4043fec940f1549aee56543f7ba6c9c309805fe7397374bed469f1e1dabb6cdad02c9f663b17c64e6bb5a248f1389c2032b15e96d46172526329c29acf04ff537049420efc71aba58f29bac5b6a09522aa893d97ca59de9cc6d13789617859c0db170443e943e58ec7604745e475d1b16057aa8975b0b668fffc9a32f8b26452fa4a95129c53f8cf9a0191898dd8694ad9f0e106d7866b3e3116f92c2921e6ed6fc03a12a2aed56d73d6f9eee8eccad27839f55aef53942c2d7efc0e765621ba72d2280c21df512628011a56fc1aae3a6e62dc87cdd0a4c0c5a179b8ae233ce785293e7eca0b76a6418b0cf798be1eaf7a33f220dbdbb5166a529f129582b5a57b01b90c5c7c48b4d7c8e8aac1677704af319bd73816bbfa344cb10f070426746f162a4fc5809a5c37d566c45043b77e53e6cfb703e511ec1e6d14200d9b859fad51fb93b2477b61435ddcbea97ebf7c4b3dacbec3f8158c5c1d317887b7233199d20d7536febb8dd255aab jtr:krb5tgs;' - creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*svc_test\$MSFLAB.LOCAL\$MSSQLSvc/sql01.msflab.local:1433\*\$cd51883 \(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+Password1!$} creds_command << ' creds add user:krb5tgs-aes128 hash:\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e jtr:krb5tgs-aes128;' creds_expected_output_regex << /krb5tgs-aes128\s+\$krb5tgs\$17\$user\$realm\$ae8434177efd09be5bc2eff8\$90b4ce5b266821adc26c64f71958 \(TRUNCATED\)\s+ Nonreplayable hash\s+krb5tgs-aes128\s+hashcat$/ creds_command << ' creds add user:krb5tgs-aes256 hash:\$krb5tgs\$18\$user\$realm\$8efd91bb01cc69dd07e46009\$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0 jtr:krb5tgs-aes256;' From 165af785b3b8f53ab3e8d3c8bb7b708d1f2a05f4 Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 24 May 2026 17:58:29 -0400 Subject: [PATCH 09/12] cracking progress --- modules/auxiliary/analyze/crack_windows.rb | 5 +---- tools/dev/hash_cracker_validator.rb | 4 ++-- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/analyze/crack_windows.rb b/modules/auxiliary/analyze/crack_windows.rb index f57aba3fccd2d..68890bd42202e 100644 --- a/modules/auxiliary/analyze/crack_windows.rb +++ b/modules/auxiliary/analyze/crack_windows.rb @@ -101,9 +101,7 @@ def process_cracker_results(results, cred) end end - puts "XXX process_cracker_results cred prior to create_cracked_credential: #{cred.inspect}" - t = create_cracked_credential(username: cred['username'], password: cred['password'], core_id: cred['core_id']) - puts "XXX create_cracked_credential returned: #{t.inspect}" + create_cracked_credential(username: cred['username'], password: cred['password'], core_id: cred['core_id']) results end @@ -178,7 +176,6 @@ def check_results(passwords, results, hash_type, method) # so we can now just go grab the username from the DB cred['username'] = framework.db.creds(workspace: myworkspace, id: cred['core_id'])[0].public.username end - puts "XXX check_results function prior to process_crack_results: #{cred.inspect}" results = process_cracker_results(results, cred) end results diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index 677b124040eec..0cc675d981730 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -185,8 +185,8 @@ def windows_hashes_and_regex_john_compat creds_expected_output_regex << /mscash-test1\s+M\$test1\#64cd29e36a8431a2b111378564a10631\s+Nonreplayable hash\s+mscash\s+test1$/ creds_command << ' creds add user:mscash2-hashcat hash:\$DCC2\$10240#tom#e4e938d12fe5974dc42a90120bd9c90f jtr:mscash2;' creds_expected_output_regex << /mscash2-hashcat\s+\$DCC2\$10240\#tom\#e4e938d12fe5974dc42a90120bd9c90f\s+Nonreplayable hash\s+mscash2\s+hashcat$/ - #creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' - #creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ + creds_command << ' creds add user:krb5asrep hash:\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac jtr:krb5asrep;' + creds_expected_output_regex << /krb5asrep\s+\$krb5asrep\$23\$user@domain.com:3e156ada591263b8aab0965f5aebd837\$007497cb51b6c \(TRUNCATED\)\s+Nonreplayable hash\s+krb5asrep\s+hashcat$/ creds_command << ' creds add user:krb5tgs hash:\$krb5tgs\$23\$*user\$realm\$test/spn*\$63386d22d359fe42230300d56852c9eb\$891ad31d09ab89c6b3b8c5e5de6c06a7f49fd559d7a9a3c32576c8fedf705376cea582ab5938f7fc8bc741acf05c5990741b36ef4311fe3562a41b70a4ec6ecba849905f2385bb3799d92499909658c7287c49160276bca0006c350b0db4fd387adc27c01e9e9ad0c20ed53a7e6356dee2452e35eca2a6a1d1432796fc5c19d068978df74d3d0baf35c77de12456bf1144b6a750d11f55805f5a16ece2975246e2d026dce997fba34ac8757312e9e4e6272de35e20d52fb668c5ed jtr:krb5tgs;' creds_expected_output_regex << %r{krb5tgs\s+\$krb5tgs\$23\$\*user\$realm\$test/spn\*\$63386d22d359fe42230300d56852c9eb\$891ad31d0\s+\(TRUNCATED\)\s+Nonreplayable hash\s+krb5tgs\s+hashcat$} return creds_command, creds_expected_output_regex From 1b25feb1be96e341ab10178c93bd99c654a7c91e Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 25 May 2026 08:09:54 -0400 Subject: [PATCH 10/12] all tests running --- tools/dev/hash_cracker_validator.rb | 82 ++++++++++++++++++++++++++++- 1 file changed, 80 insertions(+), 2 deletions(-) diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index 0cc675d981730..b53bcaf6f17a2 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -278,8 +278,13 @@ def run_msfconsole(command, expected_output_regexes) # return the common setg base settings string def base_settings(wordlist: true) - s = 'setg INCREMENTAL false;setg USE_CREDS false; setg USE_DB_INFO false; ' - s << 'setg USE_DEFAULT_WORDLIST false; setg USE_HOSTNAMES false; setg USE_ROOT_WORDS false; ' + s = 'setg INCREMENTAL false;' + s << 'setg NORMAL false;' + s << 'setg USE_CREDS false;' + s << 'setg USE_DB_INFO false;' + s << 'setg USE_DEFAULT_WORDLIST false;' + s << 'setg USE_HOSTNAMES false;' + s << 'setg USE_ROOT_WORDS false;' s << (wordlist ? 'setg WORDLIST true; ' : 'setg WORDLIST false; ') s << 'setg verbose true;' s @@ -340,6 +345,79 @@ def run_section(desc:, creds_proc:, analyzer:, use_wordlist: true, action: nil, # Create a john pot tempfile used by the pot-mode tests pot_file = Tempfile.new('john_pot') info "Pot file created at: #{pot_file.path}" +File.open(pot_file, 'w') do |file| + file.puts [ + # --- nix hashes (john format) --- + '$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/:password', # md5crypt + 'rEK1ecacw.7.c:password', # des + '_J9..K0AyUubDrfOgO4s:password', # bsdi + '$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe:password', # blowfish + '$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5:password', # sha256crypt + '$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1:password', # sha512crypt + + # --- windows hashes (john format) --- + '$LM$4a3b108f3fa6cb6d:D', # lm half 2 + '$LM$e52cac67419a9a22:PASSWOR', # lm half 1 + '$NT$8846f7eaee8fb117ad06bdd830b7586c:password', # nt + 'M$test1#64cd29e36a8431a2b111378564a10631:test1', # mscash + '$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f:hashcat', # mscash2 + '$NETNTLM$cb8086049ec4736c338d08f8e26de933$9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:hashcat', # netntlm + '$NETNTLMv2$ADMINN46iSNekpT$08ca45b7d7ea58ee$88dcbe4446168966a153a0064958dac6$5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat', # netntlmv2 + + # --- sql hashes (john + hashcat format) --- + '0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254:FOO', # mssql + '0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908:toto', # mssql05 + '0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16:Password1!', # mssql12 + '445ff82636a7ba59:probe', # mysql + '*5AD8F88516BD021DD43F171E2C785C69F8E54ADB:tere', # mysql-sha1 (john format) + 'O$SIMON#4f8bc1809cb2af77:A', # des,oracle + 'O$SYSTEM#9eedfa0ad26c6d52:THALES', # des,oracle + + # --- mobile hashes (hashcat format) --- + '9860a48ca459d054f3fef0f8518cf6872923dae2:81fcb23bcadd6c5:1234', # android-sha1 + 'd1b19a90b87fc10c304e657f37162445dae27d16:a006983800cc3dd1:1234', # android-samsung-sha1 + '1c0a0fdb673fba36beaeb078322c7393:81fcb23bcadd6c5:1234', # android-md5 + + # --- osx hashes (john + hashcat format) --- + '1430823483D07626EF8BE3FDA2FF056D0DFD818DBFE47683:hashcat', # xsha + '$LION$648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d:hashcat', # xsha512 (john format) + '$pbkdf2-hmac-sha512$35460.93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05.752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222:hashcat', # PBKDF2-HMAC-SHA512 (john format) + + # --- webapp hashes (john + hashcat format) --- + '$pbkdf2-hmac-sha1$10000$37323237333437363735323036323731$d0c38acef03f149b4b37c5a8319feeefcbd34912127ba96f3dfa5c22f49bbc1a:hashcat', # PBKDF2-HMAC-SHA1/atlassian (john format) + '$H$984478476IagS59wHZvyQMArzfx58u.:hashcat', # phpass H + '$P$984478476IagS59wHZvyQMArzfx58u.:hashcat', # phpass P + '$B$56668501$0ce106caa70af57fd525aeaf80ef2898:hashcat', # mediawiki + + # --- windows hashes (hashcat format) --- + 'e52cac67419a9a22:PASSWOR', # lm half 1 + '4a3b108f3fa6cb6d:D', # lm half 2 + '8846f7eaee8fb117ad06bdd830b7586c:password', # nt + '64cd29e36a8431a2b111378564a10631:test1:test1', # mscash + 'u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c:hashcat', # netntlm + 'ADMIN::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat', # netntlmv2 + + # --- sql hashes (hashcat format) --- + '5ad8f88516bd021dd43f171e2c785c69f8e54adb:tere', # mysql-sha1 (hashcat format) + + # --- osx hashes (hashcat format) --- + '648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d:hashcat', # xsha512 + '$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222:hashcat', # PBKDF2-HMAC-SHA512 + + # --- webapp hashes (hashcat format) --- + '{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa:hashcat', # atlassian/PBKDF2-HMAC-SHA1 + + # --- kerberos hashes --- + # john strips the username from krb5asrep pot entries: $krb5asrep$23$:password + '$krb5asrep$23$3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac:hashcat', # krb5asrep (john format) + # hashcat keeps the full $krb5asrep$23$user@domain.com:hash_body format + '$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac:hashcat', # krb5asrep (hashcat format) + '$krb5tgs$23$*user$realm$test/spn*$63386d22d359fe42230300d56852c9eb$891ad31d09ab89c6b3b8c5e5de6c06a7f49fd559d7a9a3c32576c8fedf705376cea582ab5938f7fc8bc741acf05c5990741b36ef4311fe3562a41b70a4ec6ecba849905f2385bb3799d92499909658c7287c49160276bca0006c350b0db4fd387adc27c01e9e9ad0c20ed53a7e6356dee2452e35eca2a6a1d1432796fc5c19d068978df74d3d0baf35c77de12456bf1144b6a750d11f55805f5a16ece2975246e2d026dce997fba34ac8757312e9e4e6272de35e20d52fb668c5ed:hashcat', # krb5tgs (rc4) + '$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e:hashcat', # krb5tgs-aes128 + '$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0:hashcat', # krb5tgs-aes256 + '$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380:hashcat' # timeroast + ] +end if options[:test] == 'all' || options[:test].include?(2) run_section( From f4b25e6c305fb5094b37fc0df90a1ef5651de351 Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 25 May 2026 09:59:49 -0400 Subject: [PATCH 11/12] all tests running --- .../framework/password_crackers/cracker.rb | 18 ++++++++++++++++-- .../password_crackers/hashcat/formatter.rb | 14 ++++---------- .../password_crackers/jtr/formatter.rb | 2 ++ modules/auxiliary/analyze/apply_pot.rb | 16 ++++++++++++++++ modules/auxiliary/analyze/crack_webapps.rb | 11 +++++++++-- tools/dev/hash_cracker_validator.rb | 6 ++++++ 6 files changed, 53 insertions(+), 14 deletions(-) diff --git a/lib/metasploit/framework/password_crackers/cracker.rb b/lib/metasploit/framework/password_crackers/cracker.rb index 6cc77ae928240..d1b37236632fc 100644 --- a/lib/metasploit/framework/password_crackers/cracker.rb +++ b/lib/metasploit/framework/password_crackers/cracker.rb @@ -236,6 +236,20 @@ def jtr_format_to_hashcat_format(format) end end + # Translates a jtr_format name to the format name john actually expects. + # Most formats pass through unchanged; a few have case/name discrepancies. + # + # @param format [String] A jtr_format string + # @return [String] The format name for John the Ripper + def jtr_format_to_john_format(format) + case format + when 'pbkdf2-sha256' + 'PBKDF2-HMAC-SHA256' + else + format + end + end + # This method sets the appropriate parameters to run a cracker in incremental mode def mode_incremental self.increment_length = nil @@ -423,7 +437,7 @@ def john_crack_command end if format.present? - cmd << ('--format=' + format) + cmd << ('--format=' + jtr_format_to_john_format(format)) end if wordlist.present? @@ -576,7 +590,7 @@ def show_command if cracker == 'hashcat' cmd = [cmd_string, '--show', '--username', "--potfile-path=#{pot_file}", "--hash-type=#{jtr_format_to_hashcat_format(format)}"] elsif cracker == 'john' - cmd = [cmd_string, '--show', "--pot=#{pot_file}", "--format=#{format}"] + cmd = [cmd_string, '--show', "--pot=#{pot_file}", "--format=#{jtr_format_to_john_format(format)}"] if config cmd << "--config=#{config}" diff --git a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb index 1520023e4b083..1b18c88a7a60f 100644 --- a/lib/metasploit/framework/password_crackers/hashcat/formatter.rb +++ b/lib/metasploit/framework/password_crackers/hashcat/formatter.rb @@ -51,13 +51,7 @@ def self.hash_to_hashcat(cred) # https://hashcat.net/forum/thread-7854-post-42417.html#pid42417 ironically gives Token encoding exception c = cred.private.data.sub('$pbkdf2-sha256', 'sha256').split('$') - # This method takes a string which is likely base64 encoded - # however, there is an arbitrary amount of = missing from the end - # so we attempt to add = until we are able to decode it - # - # @param str [String] the base64-ish string - # @return [String] the corrected string - def add_equals_to_base64(str) + add_equals_to_base64 = lambda do |str| ['', '=', '=='].each do |equals| to_test = "#{str}#{equals}" Base64.strict_decode64(to_test) @@ -68,9 +62,9 @@ def add_equals_to_base64(str) nil end - c[2] = add_equals_to_base64(c[2].gsub('.', '+')) # pad back out - c[3] = add_equals_to_base64(c[3].gsub('.', '+')) # pad back out - return c.join(':') + c[2] = add_equals_to_base64.call(c[2].gsub('.', '+')) # pad back out + c[3] = add_equals_to_base64.call(c[3].gsub('.', '+')) # pad back out + return "#{cred.id}:#{c.join(':')}" when /hmac-md5/ data = cred.private.data.split('#') password = Rex::Text.encode_base64("#{cred.public.username} #{data[1]}") diff --git a/lib/metasploit/framework/password_crackers/jtr/formatter.rb b/lib/metasploit/framework/password_crackers/jtr/formatter.rb index 4fc2d7d696a1e..7198a24d23179 100644 --- a/lib/metasploit/framework/password_crackers/jtr/formatter.rb +++ b/lib/metasploit/framework/password_crackers/jtr/formatter.rb @@ -65,6 +65,8 @@ def self.params_to_jtr(username, private_data, private_type, format: nil, db_id: if format.start_with?('des') # 'des,oracle', not oracle11/12c return "#{username}:O$#{username}##{private_data}:#{db_id}:" end + when /^pbkdf2-sha256/ + return "#{username}:#{private_data}:#{db_id}:" when /md5|des|bsdi|crypt|bf|sha256|sha512|xsha512/ # md5(crypt), des(crypt), b(crypt), sha256(crypt), sha512(crypt), xsha512 return "#{username}:#{private_data}:::::#{db_id}:" diff --git a/modules/auxiliary/analyze/apply_pot.rb b/modules/auxiliary/analyze/apply_pot.rb index 10f5835e1c697..b803ad8a3905d 100644 --- a/modules/auxiliary/analyze/apply_pot.rb +++ b/modules/auxiliary/analyze/apply_pot.rb @@ -92,6 +92,7 @@ def run # 'android-sha1', 'android-samsung-sha1', 'android-md5', # mobile is done with hashcat, so skip these 'PBKDF2-HMAC-SHA1', 'phpass', 'mediawiki', 'pbkdf2-sha256', # webapps 'xsha', 'xsha512', 'PBKDF2-HMAC-SHA512', # osx + 'krb5asrep', 'krb5tgs', 'krb5tgs-aes128', 'krb5tgs-aes256', 'timeroast', # kerberos 'nt', # nt needs to be 2nd to last because it can hit on android hashes 'crypt' # crypt NEEDS TO BE LAST so it doesn't accidentally read in other compatible hashes ].each do |format| @@ -159,6 +160,21 @@ def run break end end + when 'krb5asrep', 'krb5tgs', 'krb5tgs-aes128', 'krb5tgs-aes256' + # john outputs db_id:password since the hash file replaces username with db_id + next unless fields.count >= 2 + core_id = fields.shift + lookup = lookups.find { |l| l.id.to_s == core_id.to_s } + next if lookup.nil? + username = lookup.username.username + when 'timeroast' + # john outputs $sntp-ms$...$...:password since hash file has the raw hash + next unless fields.count >= 2 + hash_field = fields.shift + lookup = lookups.find { |l| l.jtr_hash == hash_field } + next if lookup.nil? + core_id = lookup.id + username = lookup.username.username when 'lm', 'nt' next unless fields.count >= 7 diff --git a/modules/auxiliary/analyze/crack_webapps.rb b/modules/auxiliary/analyze/crack_webapps.rb index 9d194215856f3..05a4bab0d3180 100644 --- a/modules/auxiliary/analyze/crack_webapps.rb +++ b/modules/auxiliary/analyze/crack_webapps.rb @@ -75,10 +75,17 @@ def check_results(passwords, results, hash_type, method) next unless fields.count >= 2 cred['core_id'] = fields.shift - cred['hash'] = fields.shift - cred['password'] = fields.join(':') # Anything left must be the password. This accounts for passwords with semi-colons in it next if cred['core_id'].include?("Hashfile '") && cred['core_id'].include?("' on line ") # skip error lines + case hash_type + when 'pbkdf2-sha256' + # hashcat format: cred_id:sha256:iterations:b64salt:b64hash:password + 4.times { fields.shift } # skip sha256, iterations, b64salt, b64hash + else + cred['hash'] = fields.shift + end + cred['password'] = fields.join(':') # Anything left must be the password. This accounts for passwords with semi-colons in it + # we don't have the username since we overloaded it with the core_id (since its a better fit for us) # so we can now just go grab the username from the DB cred['username'] = framework.db.creds(workspace: myworkspace, id: cred['core_id'])[0].public.username diff --git a/tools/dev/hash_cracker_validator.rb b/tools/dev/hash_cracker_validator.rb index b53bcaf6f17a2..af056998c7055 100755 --- a/tools/dev/hash_cracker_validator.rb +++ b/tools/dev/hash_cracker_validator.rb @@ -155,6 +155,8 @@ def webapp_hashes_and_regex creds_expected_output_regex << /phpass_h_hashcat\s+\$H\$984478476IagS59wHZvyQMArzfx58u\.\s+Nonreplayable hash\s+phpass\s+hashcat$/ creds_command << ' creds add user:atlassian_hashcat hash:{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa jtr:PBKDF2-HMAC-SHA1;' creds_expected_output_regex << %r{atlassian_hashcat\s+\{PKCS5S2\}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa\s+Nonreplayable\s+hash\s+PBKDF2-HMAC-SHA1\s+hashcat$} + creds_command << ' creds add user:pbkdf2_sha256_hashcat hash:\$pbkdf2-sha256\$1000\$c2FsdHNhbHQ\$5dqqb8uOkRAL7jFDoNsO5uunXvT78W/8jQb58DoqBe8 jtr:pbkdf2-sha256;' + creds_expected_output_regex << /pbkdf2_sha256_hashcat\s+\$pbkdf2-sha256\$1000\$c2FsdHNhbHQ\$5dqqb8uOkRAL7jFDoNsO5uunXvT78W\/8jQb58DoqBe8\s+Nonreplayable hash\s+pbkdf2-sha256\s+hashcat$/ return creds_command, creds_expected_output_regex end @@ -406,6 +408,10 @@ def run_section(desc:, creds_proc:, analyzer:, use_wordlist: true, action: nil, # --- webapp hashes (hashcat format) --- '{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa:hashcat', # atlassian/PBKDF2-HMAC-SHA1 + # john stores the full $pbkdf2-sha256$ hash in pot (no username) + '$pbkdf2-sha256$1000$c2FsdHNhbHQ$5dqqb8uOkRAL7jFDoNsO5uunXvT78W/8jQb58DoqBe8:hashcat', # pbkdf2-sha256 (john format) + # hashcat converts to sha256:iter:b64salt=:b64hash= form + 'sha256:1000:c2FsdHNhbHQ=:5dqqb8uOkRAL7jFDoNsO5uunXvT78W/8jQb58DoqBe8=:hashcat', # pbkdf2-sha256 (hashcat format) # --- kerberos hashes --- # john strips the username from krb5asrep pot entries: $krb5asrep$23$:password From cac87e4e4613fcb24ee26e1d339f47dea3fcc985 Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 25 May 2026 10:01:04 -0400 Subject: [PATCH 12/12] all tests running --- modules/auxiliary/analyze/apply_pot.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/auxiliary/analyze/apply_pot.rb b/modules/auxiliary/analyze/apply_pot.rb index b803ad8a3905d..3fcefc0e48e28 100644 --- a/modules/auxiliary/analyze/apply_pot.rb +++ b/modules/auxiliary/analyze/apply_pot.rb @@ -163,16 +163,20 @@ def run when 'krb5asrep', 'krb5tgs', 'krb5tgs-aes128', 'krb5tgs-aes256' # john outputs db_id:password since the hash file replaces username with db_id next unless fields.count >= 2 + core_id = fields.shift lookup = lookups.find { |l| l.id.to_s == core_id.to_s } next if lookup.nil? + username = lookup.username.username when 'timeroast' # john outputs $sntp-ms$...$...:password since hash file has the raw hash next unless fields.count >= 2 + hash_field = fields.shift lookup = lookups.find { |l| l.jtr_hash == hash_field } next if lookup.nil? + core_id = lookup.id username = lookup.username.username when 'lm', 'nt'