Password Hash Identifier

So I recently saw KoreLogic post a link to a password hash dump on pastebin located here: http://pastebin.com/A3JSbdzm

It was not a typical hash dump as it was not cracked or uncracked hashes, but hash types followed by examples. When faced with a funky password hash, I typically call upon john the ripper to do identification for me, however I have been in multiple scenarios where it is either unclear or john cannot identify the hash(es) I have. This pastebin dump was the kick in the pants I needed to write a tool of my own that attempts to identify the hash type of a given hash.

If an exact match cannot be found, the script will give you "possible" matches. I have incorporated the hash types mentioned above as well as the list from the hashcat site here: http://hashcat.net/wiki/doku.php?id=example_hashes

To use it you will need to download the python script and the associated hash list.

https://github.com/jakxx/Scripts/blob/master/hashes.py
https://github.com/jakxx/Scripts/blob/master/hashes.txt

Once you have them, usage is simple:

python hashes.py '[hash]'

An example can be seen below.

Cheers.

Pulling Windows Hashes Using MySQL

Heres the setup:

-Obtain access to a MySQL database
-Database user has privileges (including File privileges)
-MySQL database is running on a windows server 2003 OS
-Cannot compile a UDF (User Defined Function) to allow command execution via MySQL, as we have no shell access, only access to the database

What do we need to do? We need to move from the database to the OS. We need to compromise Windows accounts...

How are we going to do this?

Using the help from a Chinese site, that no longer seems to be up(...weird?), and quite a bit of googling, I found a way to pull binary files (most importantly SAM and SYSTEM backup files) from the underlying OS using MySQL's built-in load_file() function.

Here are the steps:

-Convert the binary file to hex
-Pull it off the machine using the database's load_file function
-Save it to a local file
-Convert the hex back into binary
-Yank hashes out of your perfectly good SAM file
-Happy dance

First we need to verify that we have FILE privileges on the target machine:

Now lets see if the machine has the backups of the SAM and SYSTEM files. On windows XP/2003, the backup files are in C:\windows\repair\.

If you can get to these files, you will see a bunch of junk output to the screen. Once the query finishes, it will look something like this:

So what? We can load the garbled data of the binary file into mysql right? Wrong.

First we need to modify our select statement to put the file contents into hex, we will do this with mysql's hex() function:

select hex(load_file('c:/windows/repair/SAM'));

We also need to dump the results to a text file on our local system to that we can work with it. After some basic googling I made a quick python script to do this for me. You can find it here. *Note you will need to edit my script.

Now that we have our hex-encoded SAM and SYSTEM files on our attacking machine we need to convert the file contents back into binary. I found an awesome perl script to do exactly that here (thanks Dr. Herong Yang :) ).

perl hex2bin.pl SAM.txt SAM

perl hex2bin.pl SYSTEM.txt SYSTEM

We should now have a perfectly usable SAM and SYSTEM binary file. We can now try to pull the hashes with bkhive and samdump2 (there are other tools like cain, etc to do this as well)

Now pass that hash, and if the admin has been lazy, you will be able to login.

Voilà

Cracking 16 Byte MySQL Hashes

In this post, I am going to talk about a tool I came across while trying to crack a pre-MySQL 4.1 password hash. As my goto hash cracker did not support this type of depreciated hash, I had to look for other methods of doing this and I came across the MySQL323 password cracker/collider located here

I found this tool to be just what I was looking for so I downloaded it and ran it. It is very easy to use and the flags for the command are very straight forward.

"mysql323 32.exe" [number of threads] [hash] [keyspace-file]

Once the program finished it gave me these statistics

Total time: 455.626 seconds (7.5 mins)
Average speed: 10.96 Tp/s

Very fast! And yes, the tp/s does stand for trillion passwords per second. The machine I ran this on has an i7 processor with 8 gigs of memory.

This will definitely be my new goto tool for these specific types of MySQL hashes.