/
githubmirror
/
metasploit-framework
Обзор
Документация
Войти
/
githubmirror
/
metasploit-framework
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
data/jtr/dynamic.conf
1 300 строк
59 KB
h00die
jtr modernizations
25 янв 2019, 22:07
25 янв 2019, 22:07
9930edf
Код
Авторство
О чём код?
# Here are some examples of DYNAMIC. # Please refer to ./doc/DYNAMIC for documentation on how to set these up. # Format names up to dynamic_999 are reserved for builtin functions. #################################################################### # here is a synopsis of the formats in this file. Please keep this up to date #################################################################### # dynamic_1001: md5(md5(md5(md5($p)))) # dynamic_1002: md5(md5(md5(md5(md5($p))))) # dynamic_1003: md5(md5($p).md5($p)) # dynamic_1004: md5(md5(md5(md5(md5(md5($p)))))) # dynamic_1005: md5(md5(md5(md5(md5(md5(md5($p))))))) # dynamic_1006: md5(md5(md5(md5(md5(md5(md5(md5($p)))))))) # dynamic_1007: md5(md5($p).$s) (vBulletin) # dynamic_1008: md5($p.$s) (RADIUS User-Password) # dynamic_1009: md5($s.$p) (RADIUS Responses) # dynamic_1010: md5($p null_padded_to_len_100) RAdmin v2.x MD5 # dynamic_1011: md5($p.md5($s)) (webEdition CMS) # dynamic_1012: md5($p.md5($s)) (webEdition CMS) # dynamic_1013: md5($p.PMD5(username)) (webEdition CMS) # dynamic_1014: md5($p.$s) (long salt) # dynamic_1015: md5(md5($p.$u).$s) (PostgreSQL 'pass the hash') # dynamic_1016: md5($p.$s) (long salt) # dynamic_1017: md5($s.$p) (long salt) # dynamic_1018: md5(sha1(sha1($p))) # dynamic_1019: md5(sha1(sha1(md5($p)))) # dynamic_1020: md5(sha1(md5($p))) # dynamic_1021: md5(sha1(md5(sha1($p)))) # dynamic_1022: md5(sha1(md5(sha1(md5($p))))) # dynamic_1023: sha1($p) (hash truncated to length 32) # dynamic_1024: sha1(md5($p)) (hash truncated to length 32) # dynamic_1025: sha1(md5(md5($p))) (hash truncated to length 32) # dynamic_1026: sha1(sha1($p)) (hash truncated to length 32) # dynamic_1027: sha1(sha1(sha1($p))) (hash truncated to length 32) # dynamic_1028: sha1(sha1_raw($p)) (hash truncated to length 32) # dynamic_1029: sha256($p) (hash truncated to length 32) # dynamic_1030: whirlpool($p) (hash truncated to length 32) # dynamic_1031: gost($p) (hash truncated to length 32) # dynamic_1032: sha1_64(utf16($p)) (PeopleSoft) # dynamic_1033: sha1_64(utf16($p).$s) # dynamic_1034: md5($p.$u) (PostgreSQL MD5) # dynamic_1300: md5(md5_raw($p)) # dynamic_1350: md5(md5($s.$p):$s) # dynamic_1400: sha1(utf16($p)) (Microsoft CREDHIST) # dynamic_1401: md5($u.\nskyper\n.$p) (Skype MD5) # dynamic_1501: sha1($s.sha1($p)) (Redmine) # dynamic_1502: sha1(sha1($p).$s) (XenForo SHA-1) # dynamic_1503: sha256(sha256($p).$s) (XenForo SHA-256) # dynamic_1504: sha1($s.$p.$s) # dynamic_1505: md5($p.$s.md5($p.$s)) # dynamic_1506: md5($u.:XDB:.$p) (Oracle 12c "H" hash) # dynamic_1507: sha1(utf16($const.$p)) (Mcafee master pass) # dynamic_1518: md5(sha1($p).md5($p).sha1($p)) # dynamic_1528: sha256($s.$p.$s) (Telegram for Android) # dynamic_1529: sha1($p null_padded_to_len_32) (DeepSound) # dynamic_1550: md5($u.:mongo:.$p) (MONGODB-CR system hash) # dynamic_1551: md5($s.$u.(md5($u.:mongo:.$p)) (MONGODB-CR network hash) # dynamic_1552: md5($s.$u.(md5($u.:mongo:.$p)) (MONGODB-CR network hash) # dynamic_1560: md5($s.$p.$s2) (SocialEngine) # dynamic_1588: sha256($s.sha1($p)) (ColdFusion 11) # dynamic_1590: sha1(utf16be(space_pad_10(uc($s)).$p)) (IBM AS/400 SHA1) # dynamic_1592: sha1($s.sha1($s.sha1($p))) (wbb3) # dynamic_1600: sha1($s.utf16le($p)) (Oracle PeopleSoft PS_TOKEN) # dynamic_1608: sha256(sha256_raw(sha256_raw($p))) (Neo Wallet) #################################################################### #################################################################### # Simple DYNAMIC type for md5($p)^^4 (i.e. 4 steps of md5 recursively) #################################################################### [List.Generic:dynamic_1001] # expression shown will be the string: dynamic_1001 md5(md5(md5(md5($p)))) Expression=md5(md5(md5(md5($p)))) Flag=MGF_KEYS_INPUT Flag=MGF_SET_INP2LEN32 MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__crypt_md5 Func=DynamicFunc__overwrite_from_last_output_to_input2_as_base16_no_size_fix #if !ARCH_LITTLE_ENDIAN // unfortunatly, we have no #define here, so we always have to call this function, in a script or they will fail on BE boxes :( Func=DynamicFunc__set_input2_len_32_cleartop #endif Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1001$57200e13b490d4ae47d5e19be026b057:test1 Test=$dynamic_1001$c6cc44f9e7fb7efcde62ba2e627a49c6:thatsworking Test=$dynamic_1001$0ae9549604e539a249c1fa9f5e5fb73b:test3 # TestM= will ONLY load in an MMX or SSE2 build of JtR. # TestF= will ONLY load in a non-MMX and nonSSE build (flat oSSL build, or generic) TestM=$dynamic_1001$94c59ab02fcd39f3ff9a4e553a4afcb6:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1001$a8b46c02f1680860622df837fa78c3e4:12345678901234567890123456789012345678901234567890123456789012345678901234567890 #################################################################### # Simple DYNAMIC type for md5($p)^^5 (i.e. 5 steps of md5 recursively) #################################################################### [List.Generic:dynamic_1002] # expression shown will be the string: dynamic_1002 md5(md5(md5(md5(md5($p))))) Expression=md5(md5(md5(md5(md5($p))))) Flag=MGF_KEYS_INPUT Flag=MGF_SET_INP2LEN32 MaxInputLen=55 MaxInputLenX86=110 # here is the optimized 'script' to perform the md5 5 times on itself. Func=DynamicFunc__crypt_md5 Func=DynamicFunc__overwrite_from_last_output_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt_md5_in2_to_out1 # These are test strings for this format. Test=$dynamic_1002$25de8cd0b0cf69c5b5bc19c8ee64adab:test1 Test=$dynamic_1002$a0b535420ea47849f7c2cc09a3ad0ac3:thatsworking Test=$dynamic_1002$4cb029bd5b4ef79f785ca685caf17bf8:test3 TestM=$dynamic_1002$5a791c6c9de2f488a8155f35900348b0:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1002$b8da59d26b6494df42b8c0f1fba8cd7e:12345678901234567890123456789012345678901234567890123456789012345678901234567890 #################################################################### # Simple DYNAMIC type for md5(md5($p).md5($p)) #################################################################### [List.Generic:dynamic_1003] # expression shown will be the string: dynamic_1003 md5(md5($p).md5($p)) Expression=md5(md5($p).md5($p)) # NOTE, this format does NOT work on SSE2. It requires a md5() of a 64 byte string. # SSE (or MMX) is limtited to 54 byte max password, due to 'enhancements' # Thus, we need a non-sse2 safe flag. ##JF Flag=MGF_NOTSSE2Safe ##JF Flag=MGF_KEYS_INPUT ##JF Flag=MGF_FULL_CLEAN_REQUIRED # here is the optimized 'script' to perform hash 'like' IPB but salt replaced with password. ##JF Func=DynamicFunc__crypt_md5 ##JF Func=DynamicFunc__clean_input2_kwik ##JF Func=DynamicFunc__append_from_last_output_to_input2_as_base16 ##JF Func=DynamicFunc__append_from_last_output_to_input2_as_base16 ##JF Func=DynamicFunc__crypt_md5_in2_to_out1 # much more optimal. From 1118k to 2155k on an SSE2 box. Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_BASE16_IN1 Flag=MGF_POOR_OMP MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__append_input_from_input Func=DynamicFunc__MD5_crypt_input1_to_output1_FINAL # These are test strings for this format. Test=$dynamic_1003$478b10974f15e7295883224fd286ccba:test1 Test=$dynamic_1003$18a59101e6c6fb38260d542a394ecb22:thatsworking Test=$dynamic_1003$630b01b68b6db6fd43a751f8147d1faf:test3 Test=$dynamic_1003$2dbecd858c29d5602da78204af7dfe1b:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 #################################################################### # Simple DYNAMIC type for md5($p)^^6 (i.e. 6 steps of md5 recursively) #################################################################### [List.Generic:dynamic_1004] # expression shown will be the string: dynamic_1004 md5(md5(md5(md5(md5(md5($p)))))) Expression=md5(md5(md5(md5(md5(md5($p)))))) Flag=MGF_KEYS_INPUT Flag=MGF_SET_INP2LEN32 MaxInputLen=55 MaxInputLenX86=110 # here is the optimized 'script' to perform the md5 6 times on itself. Func=DynamicFunc__crypt_md5 Func=DynamicFunc__overwrite_from_last_output_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt_md5_in2_to_out1 # These are test strings for this format. Test=$dynamic_1004$de1b991dd27fb9813e88b957a455dccd:test1 Test=$dynamic_1004$6a62cd3c4d81139f61fb2553cdef0dc7:thatsworking Test=$dynamic_1004$a977990e521c5d1d17c6d65fdf2681b4:test3 TestM=$dynamic_1004$e475d31b00626080fc01ca4832a33293:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1004$f60eca1ad34608b7c6b1b04379b3fee3:12345678901234567890123456789012345678901234567890123456789012345678901234567890 #################################################################### # Simple DYNAMIC type for md5($p)^^7 (i.e. 7 steps of md5 recursively) #################################################################### [List.Generic:dynamic_1005] # expression shown will be the string: dynamic_1005 md5(md5(md5(md5(md5(md5(md5($p))))))) Expression=md5(md5(md5(md5(md5(md5(md5($p))))))) Flag=MGF_KEYS_INPUT Flag=MGF_SET_INP2LEN32 MaxInputLen=55 MaxInputLenX86=110 # here is the optimized 'script' to perform the md5 7 times on itself. Func=DynamicFunc__crypt_md5 Func=DynamicFunc__overwrite_from_last_output_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt_md5_in2_to_out1 # These are test strings for this format. Test=$dynamic_1005$784c527d0d92873ff9c0773e1c35621d:test1 Test=$dynamic_1005$efcbbe6331caecf0e7f40160e65aadcc:thatsworking Test=$dynamic_1005$abb8bdd2c6ac2dfea2b2af6f5aed5446:test3 TestM=$dynamic_1005$8f853f8abf74a8e686c213a9849d9beb:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1005$37e4fc15b5dc59286aee85f4b7008315:12345678901234567890123456789012345678901234567890123456789012345678901234567890 #################################################################### # Simple DYNAMIC type for md5($p)^^8 (i.e. 8 steps of md5 recursively) #################################################################### [List.Generic:dynamic_1006] # expression shown will be the string: dynamic_1006 md5(md5(md5(md5(md5(md5(md5(md5($p)))))))) Expression=md5(md5(md5(md5(md5(md5(md5(md5($p)))))))) Flag=MGF_KEYS_INPUT Flag=MGF_SET_INP2LEN32 MaxInputLen=55 MaxInputLenX86=110 # here is the optimized 'script' to perform the md5 8 times on itself. Func=DynamicFunc__crypt_md5 Func=DynamicFunc__overwrite_from_last_output_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__overwrite_from_last_output2_to_input2_as_base16_no_size_fix Func=DynamicFunc__set_input2_len_32_cleartop Func=DynamicFunc__crypt_md5_in2_to_out1 # These are test strings for this format. Test=$dynamic_1006$1ec1f32398f64cab51183f63630eceea:test1 Test=$dynamic_1006$f66b339ac21d6fd6af216f2b70aab2c9:thatsworking Test=$dynamic_1006$e9d38522b5eeec753332e576e2e0fe5d:test3 TestM=$dynamic_1006$399310c857c0d83b931441d514528ee6:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1006$e89d92a2291b5b43b6697c51d722ae8b:12345678901234567890123456789012345678901234567890123456789012345678901234567890 #################################################################### # Simple DYNAMIC type for vBulletin md5(md5($p).$s) Included here to 'exercise' the script parser #################################################################### [List.Generic:dynamic_1007] # expression shown will be the string: dynamic_1007 md5(md5($p).$s) [vBulletin] Expression=md5(md5($p).$s) (vBulletin) # Flag needed here, is Salt. There is no 'fixed' saltlen. Flag=MGF_SALTED Flag=MGF_KEYS_BASE16_IN1 # vBulletin has a 'fixed' 3 byte salt, so list the fixed size (restriction removed). SaltLen=-23 SaltLenX86=-64 MaxInputLen=55 MaxInputLenX86=110 # here is the optimized 'script' to perform vBulletin hash Func=DynamicFunc__set_input_len_32_cleartop Func=DynamicFunc__append_salt Func=DynamicFunc__crypt_md5 Test=$dynamic_1007$daa61d77e218e42060c2fa198ac1feaf$SXB:test1 Test=$dynamic_1007$de56b00bb15d6db79204bd44383469bc$T &:thatsworking Test=$dynamic_1007$fb685c6f469f6e549c85e4c1fb5a65a6$HEX$5C483A:test3 Test=$dynamic_1007$5dd8145e0d1e2499bce05dcb4bce5cdf$HEX$24324F:testme TestM=$dynamic_1007$09019afd1303ff078ba323569ac05ea5$123:1234567890123456789012345678901234567890123456789012 TestF=$dynamic_1007$1eff62d90df7e82566f75f7cfb316f6e$PS9:12345678901234567890123456789012345678901234567890123456789012345678901234567890 #################################################################### # Dynamic type for algorithm used in RADIUS User-Password attribute md5($p.$s) #################################################################### [List.Generic:dynamic_1008] # expression shown will be this string: Expression=md5($p.$s) (RADIUS User-Password) # Flag needed here, is Salt Flag=MGF_SALTED # The salt has a fixed length of 16 bytes Saltlen=16 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt Func=DynamicFunc__crypt_md5 Test=$dynamic_1008$b962b0d40fc9111ce5f8efab424bad73$NormalSaltNormal:secret Test=$dynamic_1008$8bfccd9d67ec0bcdc38e9ae3c19a2903$FinishingwitHEX$:secret Test=$dynamic_1008$bf239357f3aa95508a53fe41b7e5f2e3$inthem$HEXiddle6:secret # unfortunately, these next 2 have embedded NULLs, so at this time they have been removed. # later we will get dynamic working with these also. #Test=$dynamic_1008$7fe3c4d1bf2ac68e94ee9f2bf75b9601$HEX$00000000000000000000000000000000:secret #Test=$dynamic_1008$658bbf9f04538d6bede09a4a52a77504$HEX$626c6168003637383930313233343536:secret TestM=$dynamic_1008$6bf84723242c758538951ebfcbe82498$Zm8EXfUeRrEJMx5b:123456789012345678901234567890123456789 TestF=$dynamic_1008$7978620b9b48b1d6e322bfe5b081bf3e$yH9RErqH2ktDYesl:1234567890123456789012345678901234567890123456789012345678901234 ###################################################################### # Dynamic Type for algorithm used in RADIUS Responses md5($s.$p) # # Also used by a "popular" backup solution # select id, name, emailid, password from administrator; # hashlib.md5((str(id) + pwd)).hexdigest() ###################################################################### [List.Generic:dynamic_1009] Expression=md5($s.$p) (RADIUS Responses) Flag=MGF_SALTED Saltlen=-16 Func=DynamicFunc__clean_input Func=DynamicFunc__append_salt Func=DynamicFunc__append_keys Func=DynamicFunc__crypt_md5 Test=$dynamic_1009$0b9b9fdf75fc79d85c5b69aa1de26288$Salt:test1 Test=$dynamic_1009$05ed3fc5e044d559290c400254e568c9$1:hackme TestM=$dynamic_1009$9619094908f5c9f29eb95eadefae84c3$ex5fKtjhZwVMCi2C:123456789012345678901234567890123456789 TestF=$dynamic_1009$92cfbd6aadc48b2ef97ca2699037dea6$73WkPYCT2CxnQ8pt:1234567890123456789012345678901234567890123456789012345678901234 ###################################################################### # Dynamic Type for algorithm used in RAdmin v2.x Responses md5($p.NULL-to-100-bytes) # v2, where keys are in input, and set_input_len_100 'cleans' up if needed. ###################################################################### [List.Generic:dynamic_1010] Expression=md5($p null_padded_to_len_100) RAdmin v2.x MD5 ##JF Flag=MGF_NOTSSE2Safe ##JF Flag=MGF_KEYS_INPUT ##JF Func=DynamicFunc__set_input_len_100 ##JF Func=DynamicFunc__crypt_md5 # MUCH faster. Went from 1930k to 5600k MaxInputLen=99 MaxInputLenX86=99 Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_INPUT Flag=MGF_POOR_OMP Func=DynamicFunc__set_input_len_100 Func=DynamicFunc__MD5_crypt_input1_to_output1_FINAL Test=$dynamic_1010$B137F09CF92F465CABCA06AB1B283C1F:lastwolf Test=$dynamic_1010$14e897b1a9354f875df51047bb1a0765:podebradka Test=$dynamic_1010$02ba5e187e2589be6f80da0046aa7e3c:12345678 Test=$dynamic_1010$b4e13c7149ebde51e510959f30319ac7:firebaLL Test=$dynamic_1010$3d2c8cae4621edf8abb081408569482b:yamaha12345 Test=$dynamic_1010$60cb8e411b02c10ecc3c98e29e830de8:xplicit #################################################################### # DYNAMIC type for webEdition CMS md5($p.md5($s)) # > select username,passwd,UseSalt from tblUser # username is salt #################################################################### [List.Generic:dynamic_1011] Expression=md5($p.md5($s)) (webEdition CMS) Flag=MGF_SALTED MaxInputLenX86=48 SaltLen=-55 MaxInputLen=23 Func=DynamicFunc__clean_input Func=DynamicFunc__append_salt Func=DynamicFunc__crypt_md5 Func=DynamicFunc__clean_input2 Func=DynamicFunc__append_keys2 Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1011$e82bf09e8a1899d4c3d00a3f380d5cdb$SXB:openwall Test=$dynamic_1011$c0e024d9200b5705bc4804722636378a$admin:admin Test=$dynamic_1011$14f8b3781f19a3b7ea520311482ce207$openwall:openwall TestM=$dynamic_1011$b8db62204359efcbfc92da2d697d21cb$xkcR9B:12345678901234567890123 TestF=$dynamic_1011$61f55f04f8f4e05392415181bcf57420$rtJEIj:123456789012345678901234567890123456789012345678 #################################################################### # DYNAMIC type for webEdition CMS md5($p.md5($s)) # > select username,passwd,UseSalt from tblUser # username is salt # Twice as fast as dynamic_1011 since md5($s) is pre-computed! #################################################################### [List.Generic:dynamic_1012] Expression=md5($p.md5($s)) (webEdition CMS) Flag=MGF_SALTED Flag=MGF_SALT_AS_HEX MaxInputLenX86=48 SaltLen=-110 MaxInputLen=23 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt Func=DynamicFunc__crypt_md5 Test=$dynamic_1012$e82bf09e8a1899d4c3d00a3f380d5cdb$SXB:openwall Test=$dynamic_1012$c0e024d9200b5705bc4804722636378a$admin:admin Test=$dynamic_1012$14f8b3781f19a3b7ea520311482ce207$openwall:openwall TestM=$dynamic_1012$b8db62204359efcbfc92da2d697d21cb$xkcR9B:12345678901234567890123 TestF=$dynamic_1012$61f55f04f8f4e05392415181bcf57420$rtJEIj:123456789012345678901234567890123456789012345678 #################################################################### ## DYNAMIC type for webEdition CMS md5($p.PMD5(username)) ## > select md5(username),passwd,UseSalt from tblUser ## PMD5(username), pre-computed md5 of username is salt ##################################################################### [List.Generic:dynamic_1013] Expression=md5($p.PMD5(username)) (webEdition CMS) Flag=MGF_SALTED MaxInputLenX86=48 MaxInputLen=23 SaltLen=32 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt Func=DynamicFunc__crypt_md5 Test=$dynamic_1013$14f8b3781f19a3b7ea520311482ce207$f2df0ddd3129c68b1ae7be05779ebeb3:openwall TestM=$dynamic_1013$b8db62204359efcbfc92da2d697d21cb$f3ae4d2b2c3600df57bbeab163eac04b:12345678901234567890123 TestF=$dynamic_1013$61f55f04f8f4e05392415181bcf57420$5e87dbf3663cbead467fc645c5c9586d:123456789012345678901234567890123456789012345678 #################################################################### # Dynamic type for md5($p.$s) for long salts #################################################################### [List.Generic:dynamic_1014] # expression shown will be this string: Expression=md5($p.$s) (long salt) # Flag needed here, is Salt Flag=MGF_SALTED ##JF Went from 1376k/1100k to 3483k/2600k by switching to flat buffer sse2 ##JF Flag=MGF_NOTSSE2Safe Flag=MGF_FLAT_BUFFERS ##JF Flag=MGF_FULL_CLEAN_REQUIRED ##JF MaxInputLen=32 MaxInputLenX86=110 MaxInputLen=110 SaltLen=-137 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt ##JF Func=DynamicFunc__crypt_md5 Func=DynamicFunc__MD5_crypt_input1_to_output1_FINAL Test=$dynamic_1014$c0dbfba522fad4054da9808a2fa09580$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:test Test=$dynamic_1014$6130b0e84d387ffd460fc83cffcc1426$bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbc:aaaa Test=$dynamic_1014$399df23011bb3742e83011c1074187e2$cccccccccccccccccccccccccccccccccccccccccccccccccccd:bbbb Test=$dynamic_1014$b962b0d40fc9111ce5f8efab424bad73$NormalSaltNormal:secret Test=$dynamic_1014$8bfccd9d67ec0bcdc38e9ae3c19a2903$FinishingwitHEX$:secret Test=$dynamic_1014$bf239357f3aa95508a53fe41b7e5f2e3$inthem$HEXiddle6:secret Test=$dynamic_1014$e463b65f14643afd970c7ea7e7efeb0f$123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890:12345678901234567890123456789012 #################################################################### # Dynamic type for md5(md5($p.$u).$s) for PostgreSQL 'pass the hash' weakness # See also dynamic_1034 for PostgreSQL MD5 # http://www.openwall.com/lists/oss-security/2015/03/03/12 #################################################################### [List.Generic:dynamic_1015] Expression=md5(md5($p.$u).$s) (PostgreSQL 'pass the hash') Flag=MGF_SALTED Flag=MGF_USERNAME MaxInputLen=31 MaxInputLenX86=56 SaltLen=-23 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_userid Func=DynamicFunc__crypt_md5 Func=DynamicFunc__clean_input2 Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__append_salt2 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1015$1d586cc8d137e5f1733f234d224393e8$HEX$f063f05d:openwall:postgres Test=$dynamic_1015$1c4e11fb51835c3bbe9851ec91ec1375$HEX$c31803a2:password:postgres Test=$dynamic_1015$bf2a64f35feba7bf1b633d60393c1356$HEX$684697c8:openwall:postgres # repeat one test in the format that is used in john.pot Test=$dynamic_1015$1d586cc8d137e5f1733f234d224393e8$HEX$f063f05d242455706f737467726573:openwall TestM=$dynamic_1015$c99b3494687ed9895d4ffca184a9daf5$M6krNt:1234567890123456789012345678901:usrx TestF=$dynamic_1015$5618a66e934dfef13cae2d06d71bdf75$usrwxT:12345678901234567890123456789012345678901234567890123456:01234 #################################################################### # Dynamic type for md5($p.$s) for long salts # NOTE, we should use dynamic_2001 and not this hash. #################################################################### [List.Generic:dynamic_1016] # expression shown will be this string: Expression=md5($p.$s) (long salt) # Flag needed here, is Salt Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS MaxInputLenX86=110 MaxInputLen=110 SaltLen=-137 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt Func=DynamicFunc__MD5_crypt_input1_to_output1_FINAL Test=$dynamic_1016$08e3ded271f83affc8f127dae3cb5bed$HEX$e30003fa000100000001000000000000000000000000000000000000000000000000000000000000d7dd1060ee06bec2:secret # repeat that hash in exactly the same form that is used in john.pot #Test=$dynamic_1016$08e3ded271f83affc8f127dae3cb5bed$HEX$48455824653330303033666130303031303030303030303130303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303064376464313036306565303662656332:secret #################################################################### # Dynamic type for md5($s.$p) for long salts # NOTE, we should use dynamic_2004 and not this hash. #################################################################### [List.Generic:dynamic_1017] # expression shown will be this string: Expression=md5($s.$p) (long salt) # Flag needed here, is Salt Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS MaxInputLenX86=55 MaxInputLen=55 SaltLen=-192 Func=DynamicFunc__clean_input Func=DynamicFunc__append_salt Func=DynamicFunc__append_keys Func=DynamicFunc__MD5_crypt_input1_to_output1_FINAL # PrestaShop uses long salts, $s == _COOKIE_KEY_ (config/settings.inc.php file) # PrestaShop hashes can be extracted from the "ps_employee" table ("ps_" is the default table prefix) # PrestaShop 1.6.0.9 was used for testing this! # Update: PrestaShop 1.7.x.y doesn't make use of the config/settings.inc.php # file. It uses bcrypt hashing, and the hashes are stored in the ps_customer # table. # # This hash format is also used by RADIUS Responses when salts are > 16 bytes long. Test=$dynamic_1017$2b3f4811983db00560dfd4c28f67bc5a$B3DdR7ZVi2N26aVbR84bjSAHht8JYhqcDr1FK49jiQXFU8Vo66PKmAFt:lemons12345 [List.Generic:dynamic_1018] Expression=md5(sha1(sha1($p))) Flag=MGF_StartInX86Mode Flag=MGF_KEYS_INPUT MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__SHA1_crypt_input1_append_input2 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__X86toSSE_switch_input2 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1018$a93dcf04edd0e2b98c1165304c250b80:1234abcd Test=$dynamic_1018$f3b5f01810c4d66ae0af85b3789e12cd:potato TestM=$dynamic_1018$5c43d21a3dfb81435d45e78334fa6109:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1018$073c8ec8e73fdedb7aad9df4ded29ba3:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1019] Expression=md5(sha1(sha1(md5($p)))) Flag=MGF_KEYS_INPUT MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__crypt_md5 Func=DynamicFunc__SSEtoX86_switch_output1 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__X86toSSE_switch_input2 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1019$86f607194f0aefe63a6c13723e94382d:jjaammaaiiccaa Test=$dynamic_1019$77faf9282c0c9b5870a4d9c3ec484aca:blink182 TestM=$dynamic_1019$bc679e2715c335fcf8b9205efd031521:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1019$36966d66615d3c0de89ca53ed88212ec:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1020] Expression=md5(sha1(md5($p))) Flag=MGF_KEYS_INPUT MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__crypt_md5 Func=DynamicFunc__SSEtoX86_switch_output1 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__X86toSSE_switch_input2 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1020$2a8ce40b837c8550506d9b5d220bac28:0124 TestM=$dynamic_1020$74102b324b8b1cf909263284a53955aa:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1020$e4ad9c1e34bad775d2cd399294c286e8:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1021] Expression=md5(sha1(md5(sha1($p)))) Flag=MGF_StartInX86Mode Flag=MGF_KEYS_INPUT MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__SHA1_crypt_input1_append_input2 Func=DynamicFunc__X86toSSE_switch_input2 Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__SSEtoX86_switch_output2 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output2_as_base16 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__X86toSSE_switch_input2 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1021$c1e054140feac1b411d3efc8bae5b881:norway TestM=$dynamic_1021$dbf8fc7a96898e16e1251d94b3bb06d9:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1021$df38670077cb4c299bcaf06e8271c986:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1022] Expression=md5(sha1(md5(sha1(md5($p))))) Flag=MGF_KEYS_INPUT MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__crypt_md5 Func=DynamicFunc__SSEtoX86_switch_output1 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__X86toSSE_switch_input2 Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__SSEtoX86_switch_output2 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output2_as_base16 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__X86toSSE_switch_input2 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1022$9caf8c249c588a89030db581ec6cea47:313131 Test=$dynamic_1022$e1eb34c6ab9e9cbe4ff67fdeb747e169:8616 TestM=$dynamic_1022$d4d51c756abefb41bafbcff7c6237618:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1022$9367b878de004be863000174e728c15f:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1023] Expression=sha1($p) (hash truncated to length 32) Flag=MGF_KEYS_INPUT Flag=MGF_FLAT_BUFFERS Flag=MGF_POOR_OMP MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1023$5baa61e4c9b93f3f0682250b6cf8331b:password Test=$dynamic_1023$e4227954acdafb57977d7dc8a1957095:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1024] Expression=sha1(md5($p)) (hash truncated to length 32) Flag=MGF_KEYS_INPUT MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__crypt_md5 Func=DynamicFunc__SSEtoX86_switch_output1 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__SHA1_crypt_input2_to_output1_FINAL Test=$dynamic_1024$c56289182ffd862d906eac1ce5c6fe6d:trigun TestM=$dynamic_1024$e290c79e9584e4cd61faded848ff96f0:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1024$609fed73c093edfbcc9913004656f360:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1025] Expression=sha1(md5(md5($p))) (hash truncated to length 32) Flag=MGF_KEYS_INPUT MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__crypt_md5 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__crypt2_md5 Func=DynamicFunc__SSEtoX86_switch_output2 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_from_last_output2_as_base16 Func=DynamicFunc__SHA1_crypt_input2_to_output1_FINAL Test=$dynamic_1025$f122db007ed655921f98184e4302bba8:123456 TestM=$dynamic_1025$006d246968ee9e761578bce26d5a82a2:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1025$cc98637054045e998ab01e97ce65585e:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1026] Expression=sha1(sha1($p)) (hash truncated to length 32) Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_INPUT MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__SHA1_crypt_input1_overwrite_input2 Func=DynamicFunc__SHA1_crypt_input2_to_output1_FINAL Test=$dynamic_1026$71b37a2d9b0a7d5dc4da8a08d9092817:peanuts Test=$dynamic_1026$30f8cf133eaac8e3b6af4bcba722921d:peanut Test=$dynamic_1026$809df50e02b68a389a8f6639a03421eb:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1027] Expression=sha1(sha1(sha1($p))) (hash truncated to length 32) Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_INPUT MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__SHA1_crypt_input1_overwrite_input2 Func=DynamicFunc__SHA1_crypt_input2_overwrite_input2 Func=DynamicFunc__SHA1_crypt_input2_to_output1_FINAL Test=$dynamic_1027$b8443c12b3066dac22b3857b2fb779b4:leelee Test=$dynamic_1027$00aeb6dc5e6269a6b2f39728cd8a6812:test1 Test=$dynamic_1027$54e45916fb79f7be1c695828fdba4491:test3 Test=$dynamic_1027$d08a9796dc4ea6decf59ce43caa1b4b4:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1028] Expression=sha1(sha1_raw($p)) (hash truncated to length 32) # currently, the raw sha1 does not work in SSE code. It does work on 'flat' x86 code Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_INPUT MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input2 Func=DynamicFunc__LargeHash_OUTMode_raw Func=DynamicFunc__SHA1_crypt_input1_append_input2 Func=DynamicFunc__SHA1_crypt_input2_to_output1_FINAL Test=$dynamic_1028$79239e0207cd5f6a472c8795c73b451d:rainbow Test=$dynamic_1028$06c0bf5b64ece2f648b5f048a7190390:test1 Test=$dynamic_1028$f357e78cabad76fd3f1018ef85d78499:test3 Test=$dynamic_1028$64ad70ca481a2c33a2c843cc03555365:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1029] Expression=sha256($p) (hash truncated to length 32) Flag=MGF_FLAT_BUFFERS MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__SHA256_crypt_input1_to_output1_FINAL Test=$dynamic_1029$e4ad93ca07acb8d908a3aa41e920ea4f:iloveyou Test=$dynamic_1029$13b1f7ec5beaefc781e43a3b344371cd:freedom Test=$dynamic_1029$aa97302150fce811425cd84537028a5a:computer Test=$dynamic_1029$75ff6bea5b0ad25171988e435c24b3ee:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1030] Expression=whirlpool($p) (hash truncated to length 32) Flag=MGF_FLAT_BUFFERS MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__WHIRLPOOL_crypt_input1_to_output1_FINAL Test=$dynamic_1030$56fd4ecb153a08b65a73b51e3c8ca369:spiral Test=$dynamic_1030$6b116ef0c32185d3ae1136f4593a5cae:defender Test=$dynamic_1030$fee8605795f28dda386324d59a28ba99:amazon Test=$dynamic_1030$73622582350099f45647970c0a8a2496:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1031] Expression=gost($p) (hash truncated to length 32) Flag=MGF_FLAT_BUFFERS MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__GOST_crypt_input1_to_output1_FINAL Test=$dynamic_1031$0e8cd409a23c2e7ad1c5b22b101dfa16:admin Test=$dynamic_1031$3b024be97641061bdd5409b4866c26c5:test1 Test=$dynamic_1031$55719211936152fbe2e1f6aa796fa866:test3 Test=$dynamic_1031$096dd6ff632727d682070752fbda548e:12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1032] Expression=sha1_64(utf16($p)) (PeopleSoft) Flag=MGF_INPBASE64m Flag=MGF_FLAT_BUFFERS Flag=MGF_UTF8 MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__setmode_unicode Func=DynamicFunc__append_keys Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1032$6Pl/upEE0epQR5SObftn+s2fW3M=:password [List.Generic:dynamic_1033] Expression=sha1_64(utf16($p).$s) Flag=MGF_INPBASE64m Flag=MGF_FLAT_BUFFERS Flag=MGF_SALTED Flag=MGF_UTF8 SaltLen=-32 MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__setmode_unicode Func=DynamicFunc__append_keys Func=DynamicFunc__setmode_normal Func=DynamicFunc__append_salt Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL # we want to make SURE that something ending with = mixed # with others NOT ending with = are handled properly. Test=$dynamic_1033$D7C1gHanUq1xE96HpEQitzAhNB8$FyKXs6zU:password Test=$dynamic_1033$sh+Q50Cp4vERzDkJcaaKIv8zubM=$M1RxMCTZ:password2 Test=$dynamic_1033$DfM7ryjrNamyG0wRS6CwheZS6Mo$3swBL4qn: #################################################################### # Dynamic type for md5($p.$u) for PostgreSQL stored MD5 hashes # See also dynamic_1015 for PostgreSQL 'pass the hash' (with salt) #################################################################### [List.Generic:dynamic_1034] Expression=md5($p.$u) (PostgreSQL MD5) Flag=MGF_USERNAME SaltLen=-32 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_userid Func=DynamicFunc__crypt_md5 Test=$dynamic_1034$bd6fd49a627ecdbe4031b2d52d5748ab:openwall:postgres Test=$dynamic_1034$32e12f215ba27cb750c9e093ce4b5127:password:postgres [List.Generic:dynamic_1300] MaxInputLen=55 MaxInputLenX86=110 Flag=MGF_POOR_OMP Expression=md5(md5_raw($p)) Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys # changed these 3 lines to the 4 lines that follow. This format has had problems # in certain builds (like generic). Likely it is the set_input_len_16 causing # issues and should be looked at. For now, the new method using input2 works fine. #Func=DynamicFunc__crypt_md5_to_input_raw #Func=DynamicFunc__set_input_len_16 #Func=DynamicFunc__crypt_md5 Func=DynamicFunc__crypt_md5 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append2_from_last_output1_as_raw Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1300$43442676c74ae59f219c2d87fd6bad52:admin Test=$dynamic_1300$5cbaca32e76bb49ca69657a9145d77ee:test1 Test=$dynamic_1300$1c8b12da6f307bbfe8d245c79d468b3d:test3 TestM=$dynamic_1300$60f3fd93d4e949d871dc7713664b2b4e:1234567890123456789012345678901234567890123456789012345 TestF=$dynamic_1300$d66e6e66ff4a8dc6f3665740268fe1bc:12345678901234567890123456789012345678901234567890123456789012345678901234567890 [List.Generic:dynamic_1350] Expression=md5(md5($s.$p):$s) # Flag needed here, is Salt. CONST1=: Flag=MGF_SALTED SaltLen=2 MaxInputLen=53 MaxInputLenX86=108 Func=DynamicFunc__clean_input Func=DynamicFunc__append_salt Func=DynamicFunc__append_keys Func=DynamicFunc__crypt_md5 Func=DynamicFunc__clean_input Func=DynamicFunc__append_from_last_output_as_base16 Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_salt Func=DynamicFunc__crypt_md5 Test=$dynamic_1350$c1f58952ab714b5ef76926628f6e0b16$92:blondie Test=$dynamic_1350$a130dbe6709653d602eec70945e14f87$9e:blondie TestM=$dynamic_1350$0f7dcf84c95a3c191a4bff15c62058a0$12:12345678901234567890123456789012345678901234567890123 TestF=$dynamic_1350$f78bdbc1c68b64f52c40d777068309fb$12:123456789012345678901234567890123456789012345678901234567890123456789012345678 # Thanks to JimF for his help in making this format work # (Jean-Michel Picod) [List.Generic:dynamic_1400] Expression=sha1(utf16($p)) (Microsoft CREDHIST) Flag=MGF_INPUT_20_BYTE Flag=MGF_StartInX86Mode Flag=MGF_POOR_OMP Flag=MGF_UTF8 MaxInputLen=55 MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__setmode_unicode Func=DynamicFunc__append_keys Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL #Test=$dynamic_1500$e8f97fba9104d1ea5047948e6dfb67fa:password Test=$dynamic_1400$e8f97fba9104d1ea5047948e6dfb67facd9f5b73:password # Thanks JimF for his help making this format to work # (Jean-Michel Picod) [List.Generic:dynamic_1401] Expression=md5($u.\nskyper\n.$p) (Skype MD5) Flag=MGF_USERNAME Flag=MGF_StartInX86Mode Flag=MGF_INPUT_20_BYTE CONST1=\x0Askyper\x0A # 23 gives us ability to do user names up to 55-8-23 (or 24 byte user names) # this should be ported to a flat format. MaxInputLen=23 MaxInputLenX86=110 SaltLen=-24 Func=DynamicFunc__clean_input Func=DynamicFunc__append_userid Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_keys Func=DynamicFunc__crypt # NOTE, I did not have full 40 byte hashes, but am using the INPUT_20_BYTE flag. # The last 8 0's are only used for valid to work, and so we can add full hashes # when we get them. Only the first 16 bytes is used in hash compare within JtR Test=$dynamic_1401$27f6a9d892475e6ce0391de8d2d893f700000000:password:username Test=$dynamic_1401$27f6a9d892475e6ce0391de8d2d893f700000000$$Uusername:password # repeat that hash in exactly the same form that is used in john.pot Test=$dynamic_1401$27f6a9d892475e6ce0391de8d2d893f700000000$HEX$2455757365726e616d65:password # In Redmine, the hashed password is stored in the following form, # SHA1(salt + SHA1(password)) # # $ mysql -u root -p # mysql> use bitnami_redmine; # Database changed # mysql> select * from users [List.Generic:dynamic_1501] Expression=sha1($s.sha1($p)) (Redmine) Flag=MGF_INPUT_20_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_BASE16_IN1_SHA1 SaltLen=32 MaxInputLenX86=110 MaxInputLen=110 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_salt2 Func=DynamicFunc__append_input2_from_input Func=DynamicFunc__SHA1_crypt_input2_to_output1_FINAL Test=$dynamic_1501$dd49e260795cb71da6904b9bccec30cb79b189f5$21737e0ab18ae77caec21f73c6e60c8d:redminecrap Test=$dynamic_1501$713769f2b8824e8f5abc2d3e4f9326f32ff1d46b$5bfe6f1c0f7a8d802032d1bf85225400:redminefff # In XenForo, the hashed password is stored in the following form(s), # sha1(sha1(password).salt) # # OR # # sha256(sha256(password).salt) # NOTE, added MGF_KEYS_BASE16_IN1_SHA1 and MGF_KEYS_BASE16_IN1_SHA256 flags # and the many salts speed is now greatly improved. [List.Generic:dynamic_1502] Expression=sha1(sha1($p).$s) (XenForo SHA-1) Flag=MGF_INPUT_20_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_BASE16_IN1_SHA1 SaltLen=-120 // dont know, so made it big, jfoug MaxInputLenX86=110 MaxInputLen=110 Func=DynamicFunc__set_input_len_40 Func=DynamicFunc__append_salt Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1502$fd74fa6521e515921ad843a8465e34b703960db1$dummysalt:password # note this hash could use the pre-compute limb-1 optimization we are wanting to do. # that would take it from 3 sha256 limbs to 1 sha256 limb (in many salts). Right now, # we have reduced it from 3 limbs to 2 limbs (for many salts). [List.Generic:dynamic_1503] Expression=sha256(sha256($p).$s) (XenForo SHA-256) Flag=MGF_INPUT_32_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_BASE16_IN1_SHA256 MaxInputLenX86=110 SaltLen=-120 // dont know, so made it big, jfoug MaxInputLen=110 Func=DynamicFunc__set_input_len_64 Func=DynamicFunc__append_salt Func=DynamicFunc__SHA256_crypt_input1_to_output1_FINAL Test=$dynamic_1503$453f2e21fa6c150670d3ecf0e4a0ff3bab8b1903c2e96ad655d960b95f104248$697de9eda4a02563a7ec66d42d4a96995cb2948e29ab76fbcc89e8db71dd10f1:password Test=$dynamic_1503$a8a0e9545c1475e8546f8546d87fe2516cf525c12ad79a6a7a8fee2fb0d8afd3$697de9eda4a02563a7ec66d42d4a96995cb2948e29ab76fbcc89e8db71dd10f1:verlongcrappypassword01234567890 # http://wiki.insidepro.com/index.php/sha1($a.$p.$s) [List.Generic:dynamic_1504] Expression=sha1($s.$p.$s) Flag=MGF_INPUT_20_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS MaxInputLenX86=110 MaxInputLen=110 SaltLen=-68 // dont know, so made it max size that fits in 4 limb buffer, jfoug Func=DynamicFunc__clean_input_kwik Func=DynamicFunc__append_salt Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1504$114e4978430ee4fe2bc492f059f5c7aa400bf2fe$Salt:abcd Test=$dynamic_1504$aab04277ffba1dee47288b05fa58d25e49a1935e$Salt:12345678 Test=$dynamic_1504$3b71a92fb2f4aeda9ae38211b67c5a4dc2a1771a$Salt: # md5($p.$s.md5($p.$s)) (saw it on https://hashcat.net/trac) [List.Generic:dynamic_1505] Expression=md5($p.$s.md5($p.$s)) # to make flat (allows much longer passwords and salts) Flag=MGF_FLAT_BUFFERS MaxInputLen=110 SaltLen=-64 Flag=MGF_SALTED MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt Func=DynamicFunc__crypt_md5 Func=DynamicFunc__clean_input2 Func=DynamicFunc__append_keys2 Func=DynamicFunc__append_salt2 Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__MD5_crypt_input2_to_output1_FINAL Test=$dynamic_1505$b8bbabb1eb9802a2e962de0207ca5172$aaaSXB:test1 # https://www.trustwave.com/Resources/SpiderLabs-Blog/Changes-in-Oracle-Database-12c-password-hashes/ [List.Generic:dynamic_1506] Expression=md5($u.:XDB:.$p) (Oracle 12c "H" hash) Flag=MGF_USERNAME CONST1=:XDB: MaxInputLen=23 MaxInputLenX86=110 SaltLen=-27 Func=DynamicFunc__clean_input Func=DynamicFunc__append_userid Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_keys Func=DynamicFunc__crypt Test=$dynamic_1506$dc9894a01797d91d92eca1da66242209:epsilon:DEMO # salt here is really a const. [List.Generic:dynamic_1507] Expression=sha1(utf16($const.$p)) (Mcafee master pass) CONST1=\x01\x0f\x0d\x33 Flag=MGF_FLAT_BUFFERS Flag=MGF_INPUT_20_BYTE MaxInputLen=110 MaxInputLenX86=110 Func=DynamicFunc__clean_input Func=DynamicFunc__setmode_unicode Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_keys Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1507$d4eaf666d09316f9d61b14753353a73d5fbcf048:test Test=$dynamic_1507$9dbe0d0ea16ae0a14c0c81a7c962b5a16e777259:test1 # Newer SunShop Shopping Cart. Older SunShop 4.1.0 uses md5($p) as the hashing # scheme. It seems that both these hash types can live together in a single # SunShop database. [List.Generic:dynamic_1518] Expression=md5(sha1($p).md5($p).sha1($p)) Flag=MGF_FLAT_BUFFERS MaxInputLenX86=110 MaxInputLen=110 Func=DynamicFunc__clean_input_kwik Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_keys Func=DynamicFunc__SHA1_crypt_input1_append_input2 Func=DynamicFunc__MD5_crypt_input1_append_input2 Func=DynamicFunc__SHA1_crypt_input1_append_input2 Func=DynamicFunc__MD5_crypt_input2_to_output1_FINAL Test=$dynamic_1518$c756b56aed8d6748ee63e1e270c71a3f:password Test=$dynamic_1518$8e6db6b58e9e326aba17e19a36c79d95:menura Test=$dynamic_1518$2abe0f6794cc57663527ce7ab81fdaf3:stealth Test=$dynamic_1518$08793c9ab17a586b3af71d28e1cae2c1:fletch Test=$dynamic_1518$b19d46258f6a00f151367024789d71f1:smurfs Test=$dynamic_1518$065c78f47a7da2e2ca2bd76eed10f6cd:ralphy1 Test=$dynamic_1518$82f7dd8a757d1a79126817940336087d:Kitesurfing1 # Telegram for Android hashes. Use ../run/telegram2john.py to extract the hashes. [List.Generic:dynamic_1528] Expression=sha256($s.$p.$s) (Telegram for Android) Flag=MGF_INPUT_32_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS SaltLen=16 Func=DynamicFunc__clean_input_kwik Func=DynamicFunc__append_salt Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt Func=DynamicFunc__SHA256_crypt_input1_to_output1_FINAL Test=$dynamic_1528$dab5552484cc327bd6d23b2a1ceb55b6ffb30f305bc09962a9102a6cec63773c$HEX$9533cd79bf8739bdd47ff8998aaf578c:1234 Test=$dynamic_1528$cad3fe1d4df2bf68c23f003e771c79fa42d10ae9a03671019d9c91a266a91372$HEX$901c3371d7de4b525b0e0a6abf4f392e:0987 # DeepSound hashes. Use ../run/deepsound2john.py to extract the hashes. [List.Generic:dynamic_1529] Expression=sha1($p null_padded_to_len_32) (DeepSound) Flag=MGF_INPUT_20_BYTE Flag=MGF_FLAT_BUFFERS Func=DynamicFunc__clean_input Func=DynamicFunc__append_keys Func=DynamicFunc__set_input_len_32 Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1529$6f9fa2285514c73bcac858496361f19f477ee416:deep5ound Test=$dynamic_1529$66cad8923499423fa0c1d3974256d957840b9d69:iqlusion Test=$dynamic_1529$a3eb15172cc7e6090a2eb32e6dc8c3bd30c39a02:abcdefghijklmnopqrstuvwxyz012345 # MONGODB-CR system hashes # Input hash format => username:$dynamic_1550$hash [List.Generic:dynamic_1550] Expression=md5($u.:mongo:.$p) (MONGODB-CR system hash) Flag=MGF_USERNAME CONST1=:mongo: MaxInputLen=23 MaxInputLenX86=110 # note, saltlen + length(:mongo:) + length(plain) must stay <= 55 for SIMD # so 25+7+23 == 55 SaltLen=-25 Func=DynamicFunc__clean_input Func=DynamicFunc__append_userid Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_keys Func=DynamicFunc__crypt Test=$dynamic_1550$08f32db65f837a52cd791bd923a61e95$$Usomeadmin:secret Test=$dynamic_1550$819951ad797c3564148a77cbecf3b166$$Uadmin:secret@12345 # MONGODB-CR network hashes (user name < 8 bytes long) # Input hash format => username:$dynamic_1551$hash$salt$$Uusername [List.Generic:dynamic_1551] Expression=md5($s.$u.(md5($u.:mongo:.$p)) (MONGODB-CR network hash) Flag=MGF_USERNAME CONST1=:mongo: MaxInputLen=23 MaxInputLenX86=110 # note, saltlen + length(:mongo:) + length(plain) must stay <= 55 for SIMD # so 25+7+23 == 55 SaltLen=16 Func=DynamicFunc__clean_input Func=DynamicFunc__clean_input2 Func=DynamicFunc__append_userid Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt2 Func=DynamicFunc__append_userid2 Func=DynamicFunc__crypt Func=DynamicFunc__append_from_last_output_to_input2_as_base16 Func=DynamicFunc__crypt_md5_in2_to_out1 Test=$dynamic_1551$0c85e3f74adce5d037426791940c820a$58d3229c83e3f87e$$Usa:sa Test=$dynamic_1551$797d7e18879446845f10ae9d519960b2$10441db416a99ffc$$Usa:longpassword Test=$dynamic_1551$a5ca2c517c06fdfb773144d53fb26f56$9b90cf265f3194d7$$UHerman:123456789 Test=$dynamic_1551$441d6ece7356c67dcc69dd26e7e0501f$be8fa52f0e64c250$$Usz110:passWOrd Test=$dynamic_1551$c95e106f1d9952c88044a0b21a6bd3fd$304b81adddfb4d6f$$Ujack: # MONGODB-CR network hashes (user name >= 8 bytes long) # Input hash format => username:$dynamic_1552$hash$salt$$Uusername [List.Generic:dynamic_1552] Expression=md5($s.$u.(md5($u.:mongo:.$p)) (MONGODB-CR network hash) Flag=MGF_USERNAME Flag=MGF_FLAT_BUFFERS CONST1=:mongo: MaxInputLen=110 MaxInputLenX86=110 SaltLen=16 Func=DynamicFunc__clean_input_kwik Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_userid Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_keys Func=DynamicFunc__append_salt2 Func=DynamicFunc__append_userid2 Func=DynamicFunc__MD5_crypt_input1_append_input2 Func=DynamicFunc__MD5_crypt_input2_to_output1_FINAL Test=$dynamic_1552$10290925d16d81e50db242c9f3572d91$0000000000000000$$Ulongusername:longpassword@12345678 Test=$dynamic_1552$53257e018399a241849cb04c70ba8daa$0000000000000000$$Ulongusername:longpassword Test=$dynamic_1552$1abe48bac6ad0bf567ab51b094f026a9$86336266301fb552$$Ulongusername:longpassword Test=$dynamic_1552$5c414259f7f7a42f8c4d1b6ffb37913a$8c82aec197929775$$Ueight18_characters:123 # SocialEngine hashes (Elijah [W&P]) # # hash = md5('core secret'.'password'.'salt') # core.secret -> MySQL 'engine4_core_settings' table, row 'core.secret' # salt -> MySQL 'engine4_users' table, 'salt' column [List.Generic:dynamic_1560] Expression=md5($s.$p.$s2) (SocialEngine) Flag=MGF_SALTED Flag=MGF_SALTED2 Flag=MGF_FLAT_BUFFERS SaltLen=-46 Func=DynamicFunc__clean_input Func=DynamicFunc__append_salt Func=DynamicFunc__append_keys Func=DynamicFunc__append_2nd_salt Func=DynamicFunc__MD5_crypt_input1_to_output1_FINAL Test=$dynamic_1560$55fce7789372d510023fc819c0ce55a6$a6ebe407fa6e2337cb2deb573d17791e$$21060744:test1 Test=$dynamic_1560$fd880f2c10f148c409f3c850a52201b0$6cbe843e024f59827c55f3a32d1c3be9$$22262250:thatsworking Test=$dynamic_1560$2b199a07acf8e9e36e47ec2a0178933b$2a4c7cf421315f49fae230e80acfa218$$29597016:test3 Test=$dynamic_1560$13d806a7e87bc1b551478742349882a9$2161869cadcb41f1cc1e939f191c0bb35e58a9a7$$21060744:123123 # ColdFusion 11 hashes (Ivan Novikov <in@wallarm.com>) # Hash is password variable from ./lib/password.properties # Salt is admin.userid.root.salt variable from ./lib/neo-security.xml [List.Generic:dynamic_1588] Expression=sha256($s.sha1($p)) (ColdFusion 11) Flag=MGF_INPUT_32_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS Flag=MGF_BASE_16_OUTPUT_UPCASE SaltLen=64 Func=DynamicFunc__clean_input_kwik Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_salt Func=DynamicFunc__append_keys2 Func=DynamicFunc__SHA1_crypt_input2_append_input1 Func=DynamicFunc__SHA256_crypt_input1_to_output1_FINAL Test=$dynamic_1588$37F816D599BFD69C5A0D750198AB6E46E26CEB120C9AF3B1E5306515058CBAE8$D7B6D57262290BC0A634D2D1A0DFE59F1FBE47885DBC9BB1CEBA8EA9D09D9839:test1234 # IBM AS/400 SHA1 hashes !NOTE, salt is pre prepared, utf16be(space_pad_10(uc($user_name)) [List.Generic:dynamic_1590] Expression=sha1(utf16be(space_pad_10(uc($s)).$p)) (IBM AS/400 SHA1) Flag=MGF_INPUT_20_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS Flag=MGF_BASE_16_OUTPUT_UPCASE Flag=MGF_UTF8 SaltLen=20 Func=DynamicFunc__clean_input_kwik Func=DynamicFunc__append_salt Func=DynamicFunc__setmode_unicodeBE Func=DynamicFunc__append_keys Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1590$4C106E52CA196986E1C52C7FCD02AF046B76C73C$HEX$0052004F00420020002000200020002000200020:banaan Test=$dynamic_1590$CED8050C275A5005D101051FF5BCCADF693E8AB7$HEX$0042004100520054002000200020002000200020:Kulach007 Test=$dynamic_1590$1BA6C7D54E9696ED33F4DF201E348CA8CA815F75$HEX$005300590053004F005000520020002000200020:T0Psecret! Test=$dynamic_1590$A1284B4F1BDD7ED598D4B5060D861D6D614620D3$HEX$00530059005300540045004D0020002000200020:P@ssword01 Test=$dynamic_1590$94C55BC7EDF1996AC62E8145CDBFA285CA79ED2E$HEX$0051005300590053004400420041002000200020:qsysdba Test=$dynamic_1590$CDF4063E283B51EDB7B9A8E6E542042000BD9AE9$HEX$0051005300450043004F00460052002000200020:qsecofr! Test=$dynamic_1590$44D43148CFE5CC3372AFD2610BEE3D226B2B50C5$HEX$0054004500530054003100200020002000200020:password1 Test=$dynamic_1590$349B12D6588843A1632649A501ABC353EBF409E4$HEX$0054004500530054003200200020002000200020:secret Test=$dynamic_1590$A97F2F9ED9977A8A628F8727E2851415B06DC540$HEX$0054004500530054003300200020002000200020:test3 # wbb3 SHA1 hashes [List.Generic:dynamic_1592] Expression=sha1($s.sha1($s.sha1($p))) (wbb3) Flag=MGF_INPUT_20_BYTE Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS Flag=MGF_KEYS_BASE16_IN1_SHA1 Flag=MGF_FULL_CLEAN_REQUIRED2 SaltLen=40 Func=DynamicFunc__clean_input2_kwik Func=DynamicFunc__append_salt2 Func=DynamicFunc__append_input2_from_input Func=DynamicFunc__LargeHash_set_offset_40 Func=DynamicFunc__SHA1_crypt_input2_at_offset_input2 Func=DynamicFunc__SHA1_crypt_input2_to_output1_FINAL Test=$dynamic_1592$e2063f7c629d852302d3020599376016ff340399$0b053db07dc02bc6f6e24e00462f17e3c550afa9:123456 Test=$dynamic_1592$f6975cc560c5d03feb702158d08f90bf2fa773d6$0b053db07dc02bc6f6e24e00462f17e3c550afa9:password Test=$dynamic_1592$2c56d23b44eb122bb176dfa2a1452afaf89f1143$a710463f75bf4568d398db32a53f9803007388a3:123456 Test=$dynamic_1592$2596b5f8e7cdaf4b15604ad336b810e8e2935b1d$1039145e9e785ddb2ac7ccca89ac1b159b595cc1:12345678 Test=$dynamic_1592$26496a87c1a7dd68f7beceb2fc40b6fc4223a453$db763342e23f8ccdbd9c90d1cc7896d80b7e0a44:12345678 Test=$dynamic_1592$d945c02cf85738b7db4f4f05edd676283280a513$bf2c7d0c8fb6cb146adf8933e32da012d31b5bbb:123456789 Test=$dynamic_1592$e3e03fe02223c5030e834f81997f614b43441853$d132b22d3f1d942b99cc1f5fbd5cc3eb0824d608:1234567890 # All credit for this format goes to Alexey Tyurin (ERPScan), François Gaudreault, and Martin Lemay # http://gosecure.net/2016/05/04/oracle-peoplesoft-still-a-threat-for-enterprises/ (source) # https://erpscan.com/press-center/blog/peoplesoft-security-part-4-peoplesoft-pentest-using-tokenchpoken-tool/ # https://erpscan.com/wp-content/uploads/tools/ERPScan-tockenchpoken.zip [List.Generic:dynamic_1600] Expression=sha1($s.utf16le($p)) (Oracle PeopleSoft PS_TOKEN) Flag=MGF_INPUT_20_BYTE Flag=MGF_FLAT_BUFFERS Flag=MGF_SALTED Flag=MGF_UTF8 SaltLen=-150 Func=DynamicFunc__clean_input Func=DynamicFunc__append_salt Func=DynamicFunc__setmode_unicode Func=DynamicFunc__append_keys Func=DynamicFunc__SHA1_crypt_input1_to_output1_FINAL Test=$dynamic_1600$e6155f87b073451076d81e3505f8b9fcd3f53b5a$HEX$710000000403020101000000bc0200000000000010500050005700450042004500580054000645004e0047000e50005300460054005f00480052003432003000310036002d00300034002d00300038002d00310039002e00320037002e00300035002e0030003000300030003000320000:password Test=$dynamic_1600$b5e335754127b25ba6f99a94c738e24cd634c35a$HEX$aa07d396f5038a6cbeded88d78d1d6c907e4079b3dc2e12fddee409a51cc05ae73e8cc24d518c923a2f79e49376594503e6238b806bfe33fa8516f4903a9b4:hashcat Test=$dynamic_1600$ac869d82e768c1af0e2b80679ddee8efe769d480$HEX$650000000403020101000000bc0200000000000004500053000645004e0047000e50005300460054005f00480052003432003000310035002d00300037002d00300031002d00300038002e00300036002e00340036002e0039003900390035003400330000:password@12345 # https://github.com/neo-project/neo-gui (tested with Neo GUI v2.3.2) [List.Generic:dynamic_1608] Expression=sha256(sha256_raw(sha256_raw($p))) (Neo Wallet) Flag=MGF_FLAT_BUFFERS Flag=MGF_INPUT_32_BYTE MaxInputLenX86=110 MaxInputLen=110 Func=DynamicFunc__clean_input_kwik Func=DynamicFunc__LargeHash_OUTMode_raw Func=DynamicFunc__append_keys Func=DynamicFunc__SHA256_crypt_input1_overwrite_input2 Func=DynamicFunc__SHA256_crypt_input2_overwrite_input2 Func=DynamicFunc__SHA256_crypt_input2_to_output1_FINAL Test=$dynamic_1608$f2a778f1a6ed3d5bc59a5d79104c598f3f07093f240ca4e91333fb09ed4f36da:abc Test=$dynamic_1608$8b12147de49a2832aca47a5bf6fbca12689420ac14c2547ab90f6d495f21f6dc:ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEF Test=$dynamic_1608$2a1a9918abe22f14d737462301e0c17b125a5f9ba11dc1e872b5320180437d12:openwall # https://www.oneidentity.com/products/authentication-services/ # Author: Tim Brown. Borrowed from https://github.com/portcullislabs/linikatz (under BSD 3-Clause "New" or "Revised" License). [List.Generic:dynamic_1602] Expression=sha256(#.$salt.-.$pass) (QAS vas_auth) Flag=MGF_INPUT_32_BYTE Flag=MGF_USERNAME Flag=MGF_SALTED Flag=MGF_FLAT_BUFFERS CONST1=# CONST2=- SaltLen=36 Func=DynamicFunc__clean_input Func=DynamicFunc__append_input1_from_CONST1 Func=DynamicFunc__append_salt Func=DynamicFunc__append_input1_from_CONST2 Func=DynamicFunc__append_keys Func=DynamicFunc__SHA256_crypt_input1_to_output1_FINAL Test=$dynamic_1602$9b4d1328a3dc064704301d2da2975f97b9212d8f08539214b27fd3106dc208ff$C34208EA-8C33-473D-A9B4-53FB40347EA0:P0rtcu11i5!:Administrator@3rd-party.example.org # this should be last line of the file. Put other formats before this. The formats in # the following included file are replacement formats for the MD4/5 formats which use # 'intermixed' SSE for speed, BUT which can not process longer passwords, due to being # limited to a single SSE buffer. The formats in dynamic_flat_sse_formats.conf are using # the large hash 'flat' methods, which allow multiple SSE buffers. They are slower (sometimes # a LOT slower), than the intermixed SSE. But they are much faster than oSSL code, and can # take full length passwords (110 bytes). .include <dynamic_flat_sse_formats.conf>