Skip to content

Adding support for AES-256 (-m 19851) and syncing up to latest dev of hashcat #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Adding support for AES-256 (-m 19851) and syncing up to latest dev of hashcat #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9e440fd
Fixed build errors and "Old template?" error for newer versions of Ha…
missing0x00 Jul 20, 2023
597c1bd
Fixed the fix
missing0x00 Jul 20, 2023
d9a8efd
Adding port up to hashcat 6.2.6 and dev from @missing0x00
blurbdust Jun 4, 2025
6ec09fa
Adding AES-256 version of SCCM module
blurbdust Jun 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions module_code/module_19850.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,9 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE

u32 *digest = (u32 *) digest_buf;
u32 payload[4];
token_t token;
hc_token_t token;

memset (&token, 0, sizeof (hc_token_t));

token.token_cnt = 5;
/* 40 byte header
Expand Down Expand Up @@ -133,10 +135,13 @@ void module_init (module_ctx_t *module_ctx)
module_ctx->module_interface_version = MODULE_INTERFACE_VERSION_CURRENT;

module_ctx->module_attack_exec = module_attack_exec;
module_ctx->module_benchmark_charset = MODULE_DEFAULT;
module_ctx->module_benchmark_esalt = MODULE_DEFAULT;
module_ctx->module_benchmark_hook_salt = MODULE_DEFAULT;
module_ctx->module_benchmark_mask = MODULE_DEFAULT;
module_ctx->module_benchmark_salt = MODULE_DEFAULT;
module_ctx->module_bridge_name = MODULE_DEFAULT;
module_ctx->module_bridge_type = MODULE_DEFAULT;
module_ctx->module_build_plain_postprocess = MODULE_DEFAULT;
module_ctx->module_deep_comp_kernel = MODULE_DEFAULT;
module_ctx->module_deprecated_notice = MODULE_DEFAULT;
Expand All @@ -154,6 +159,7 @@ void module_init (module_ctx_t *module_ctx)
module_ctx->module_hash_binary_count = MODULE_DEFAULT;
module_ctx->module_hash_binary_parse = MODULE_DEFAULT;
module_ctx->module_hash_binary_save = MODULE_DEFAULT;
module_ctx->module_hash_decode_postprocess = MODULE_DEFAULT;
module_ctx->module_hash_decode_potfile = MODULE_DEFAULT;
module_ctx->module_hash_decode_zero_hash = MODULE_DEFAULT;
module_ctx->module_hash_decode = module_hash_decode;
Expand Down Expand Up @@ -203,4 +209,4 @@ void module_init (module_ctx_t *module_ctx)
module_ctx->module_tmp_size = MODULE_DEFAULT;
module_ctx->module_unstable_warning = MODULE_DEFAULT;
module_ctx->module_warmup_disable = MODULE_DEFAULT;
}
}
211 changes: 211 additions & 0 deletions module_code/module_19851.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,211 @@
/**
* Author......: Christopher Panayi, MWR CyberSec
* License.....: MIT
*/

#include "common.h"
#include "types.h"
#include "modules.h"
#include "bitops.h"
#include "convert.h"
#include "shared.h"

static const u32 ATTACK_EXEC = ATTACK_EXEC_INSIDE_KERNEL; //Fast Kernel
static const u32 DGST_POS0 = 0;
static const u32 DGST_POS1 = 1;
static const u32 DGST_POS2 = 2;
static const u32 DGST_POS3 = 3;
static const u32 DGST_SIZE = DGST_SIZE_4_4;
static const u32 HASH_CATEGORY = HASH_CATEGORY_GENERIC_KDF;
static const char *HASH_NAME = "ConfigMgr CryptDeriveKey encrypted media variable file, AES-256";
static const u64 KERN_TYPE = 19851;
static const u32 OPTI_TYPE = OPTI_TYPE_ZERO_BYTE
| OPTI_TYPE_NOT_ITERATED
| OPTI_TYPE_NOT_SALTED;
static const u64 OPTS_TYPE = OPTS_TYPE_PT_GENERATE_LE
| OPTS_TYPE_HASH_COPY; //This copies the string of the hash to host memory, so that you can just print it out in hash_encode
static const u32 SALT_TYPE = SALT_TYPE_NONE; //No Salt
static const char *ST_PASS = "Password1";
static const char *ST_HASH = "$sccm$aes256$0000edec14000000ca320000d032000010660000000000003dd6b8bc6cc41f718b07522266e188ce";

u32 module_attack_exec (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return ATTACK_EXEC; }
u32 module_dgst_pos0 (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return DGST_POS0; }
u32 module_dgst_pos1 (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return DGST_POS1; }
u32 module_dgst_pos2 (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return DGST_POS2; }
u32 module_dgst_pos3 (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return DGST_POS3; }
u32 module_dgst_size (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return DGST_SIZE; }
u32 module_hash_category (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return HASH_CATEGORY; }
const char *module_hash_name (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return HASH_NAME; }
u64 module_kern_type (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return KERN_TYPE; }
u32 module_opti_type (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return OPTI_TYPE; }
u64 module_opts_type (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return OPTS_TYPE; }
u32 module_salt_type (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return SALT_TYPE; }
const char *module_st_hash (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return ST_HASH; }
const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const user_options_t *user_options, MAYBE_UNUSED const user_options_extra_t *user_options_extra) { return ST_PASS; }

static const char *SIGNATURE_SCCMAES256 = "$sccm$aes256$";

int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED void *digest_buf, MAYBE_UNUSED salt_t *salt, MAYBE_UNUSED void *esalt_buf, MAYBE_UNUSED void *hook_salt_buf, MAYBE_UNUSED hashinfo_t *hash_info, const char *line_buf, MAYBE_UNUSED const int line_len)
{
const u32 aes_bytes = 26128U; //CALG_AES_256 0x00006610 as unsigned int

u32 *digest = (u32 *) digest_buf;
u32 payload[4];
hc_token_t token;

memset (&token, 0, sizeof (hc_token_t));
token.token_cnt = 5;
/* 40 byte header
* 16 byte - Header bytes (Maybe Magic bytes?)
* 4 byte - ALG_ID bytes (https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id)
* 4 byte - Header bytes (Maybe Magic bytes?)
* 16 byte - Payload bytes (Encrypted data)
*/

token.signatures_cnt = 1;
token.signatures_buf[0] = SIGNATURE_SCCMAES256;

token.len[0] = 13;
token.attr[0] = TOKEN_ATTR_FIXED_LENGTH
| TOKEN_ATTR_VERIFY_SIGNATURE;

token.len[1] = 32; //Header
token.attr[1] = TOKEN_ATTR_FIXED_LENGTH
| TOKEN_ATTR_VERIFY_HEX;
token.len[2] = 8; //ALG_ID
token.attr[2] = TOKEN_ATTR_FIXED_LENGTH
| TOKEN_ATTR_VERIFY_HEX;
token.len[3] = 8; //Header
token.attr[3] = TOKEN_ATTR_FIXED_LENGTH
| TOKEN_ATTR_VERIFY_HEX;
token.len[4] = 32; //Encrypted data
token.attr[4] = TOKEN_ATTR_FIXED_LENGTH
| TOKEN_ATTR_VERIFY_HEX;

setbuf(stdout, NULL);
const int rc_tokenizer = input_tokenizer ((const u8 *) line_buf, line_len, &token);
if (rc_tokenizer != PARSER_OK) return (rc_tokenizer);

u32 enc_alg_sig[1];
u8 bytes_sig[token.len[2]];
u8 bytes_digest[token.len[4]];

//Decode hex string to u8
hex_decode(token.buf[2],token.len[2],bytes_sig);
hex_decode(token.buf[4],token.len[4],bytes_digest);

//Convert u8 to u32 data types
memcpy(enc_alg_sig, bytes_sig, 4);
memcpy(payload, bytes_digest, 16);

//Check that ALG_ID == CALG_AES_256 (0x00006610), else the file is not AES encrypted
if(*enc_alg_sig != aes_bytes)
{
return (PARSER_SIGNATURE_UNMATCHED);
}

//Correct endianess of payload bytes
int i;
for (i = 0; i < 4; i++)
{
payload[i] = byte_swap_32 (payload[i]);
}

//Store encrypted data as digest for comparison in kernel code
digest[0] = payload[0];
digest[1] = payload[1];
digest[2] = payload[2];
digest[3] = payload[3];
return (PARSER_OK);
}

//Idea here is that this module will never really be called with many of these "hashes", so maybe it is worth storing the original hash on the host in this case
int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSED const void *digest_buf, MAYBE_UNUSED const salt_t *salt, MAYBE_UNUSED const void *esalt_buf, MAYBE_UNUSED const void *hook_salt_buf, MAYBE_UNUSED const hashinfo_t *hash_info, char *line_buf, MAYBE_UNUSED const int line_size)
{
const int line_len = snprintf (line_buf, line_size, "%s",
hash_info->orighash);

return line_len;
}

void module_init (module_ctx_t *module_ctx)
{
module_ctx->module_context_size = MODULE_CONTEXT_SIZE_CURRENT;
module_ctx->module_interface_version = MODULE_INTERFACE_VERSION_CURRENT;

module_ctx->module_attack_exec = module_attack_exec;
module_ctx->module_benchmark_charset = MODULE_DEFAULT;
module_ctx->module_benchmark_esalt = MODULE_DEFAULT;
module_ctx->module_benchmark_hook_salt = MODULE_DEFAULT;
module_ctx->module_benchmark_mask = MODULE_DEFAULT;
module_ctx->module_benchmark_salt = MODULE_DEFAULT;
module_ctx->module_bridge_name = MODULE_DEFAULT;
module_ctx->module_bridge_type = MODULE_DEFAULT;
module_ctx->module_build_plain_postprocess = MODULE_DEFAULT;
module_ctx->module_deep_comp_kernel = MODULE_DEFAULT;
module_ctx->module_deprecated_notice = MODULE_DEFAULT;
module_ctx->module_dgst_pos0 = module_dgst_pos0;
module_ctx->module_dgst_pos1 = module_dgst_pos1;
module_ctx->module_dgst_pos2 = module_dgst_pos2;
module_ctx->module_dgst_pos3 = module_dgst_pos3;
module_ctx->module_dgst_size = module_dgst_size;
module_ctx->module_dictstat_disable = MODULE_DEFAULT;
module_ctx->module_esalt_size = MODULE_DEFAULT;
module_ctx->module_extra_buffer_size = MODULE_DEFAULT;
module_ctx->module_extra_tmp_size = MODULE_DEFAULT;
module_ctx->module_extra_tuningdb_block = MODULE_DEFAULT;
module_ctx->module_forced_outfile_format = MODULE_DEFAULT;
module_ctx->module_hash_binary_count = MODULE_DEFAULT;
module_ctx->module_hash_binary_parse = MODULE_DEFAULT;
module_ctx->module_hash_binary_save = MODULE_DEFAULT;
module_ctx->module_hash_decode_postprocess = MODULE_DEFAULT;
module_ctx->module_hash_decode_potfile = MODULE_DEFAULT;
module_ctx->module_hash_decode_zero_hash = MODULE_DEFAULT;
module_ctx->module_hash_decode = module_hash_decode;
module_ctx->module_hash_encode_status = MODULE_DEFAULT;
module_ctx->module_hash_encode_potfile = MODULE_DEFAULT;
module_ctx->module_hash_encode = module_hash_encode;
module_ctx->module_hash_init_selftest = MODULE_DEFAULT;
module_ctx->module_hash_mode = MODULE_DEFAULT;
module_ctx->module_hash_category = module_hash_category;
module_ctx->module_hash_name = module_hash_name;
module_ctx->module_hashes_count_min = MODULE_DEFAULT;
module_ctx->module_hashes_count_max = MODULE_DEFAULT;
module_ctx->module_hlfmt_disable = MODULE_DEFAULT;
module_ctx->module_hook_extra_param_size = MODULE_DEFAULT;
module_ctx->module_hook_extra_param_init = MODULE_DEFAULT;
module_ctx->module_hook_extra_param_term = MODULE_DEFAULT;
module_ctx->module_hook12 = MODULE_DEFAULT;
module_ctx->module_hook23 = MODULE_DEFAULT;
module_ctx->module_hook_salt_size = MODULE_DEFAULT;
module_ctx->module_hook_size = MODULE_DEFAULT;
module_ctx->module_jit_build_options = MODULE_DEFAULT;
module_ctx->module_jit_cache_disable = MODULE_DEFAULT;
module_ctx->module_kernel_accel_max = MODULE_DEFAULT;
module_ctx->module_kernel_accel_min = MODULE_DEFAULT;
module_ctx->module_kernel_loops_max = MODULE_DEFAULT;
module_ctx->module_kernel_loops_min = MODULE_DEFAULT;
module_ctx->module_kernel_threads_max = MODULE_DEFAULT;
module_ctx->module_kernel_threads_min = MODULE_DEFAULT;
module_ctx->module_kern_type = module_kern_type;
module_ctx->module_kern_type_dynamic = MODULE_DEFAULT;
module_ctx->module_opti_type = module_opti_type;
module_ctx->module_opts_type = module_opts_type;
module_ctx->module_outfile_check_disable = MODULE_DEFAULT;
module_ctx->module_outfile_check_nocomp = MODULE_DEFAULT;
module_ctx->module_potfile_custom_check = MODULE_DEFAULT;
module_ctx->module_potfile_disable = MODULE_DEFAULT;
module_ctx->module_potfile_keep_all_hashes = MODULE_DEFAULT;
module_ctx->module_pwdump_column = MODULE_DEFAULT;
module_ctx->module_pw_max = MODULE_DEFAULT;
module_ctx->module_pw_min = MODULE_DEFAULT;
module_ctx->module_salt_max = MODULE_DEFAULT;
module_ctx->module_salt_min = MODULE_DEFAULT;
module_ctx->module_salt_type = module_salt_type;
module_ctx->module_separator = MODULE_DEFAULT;
module_ctx->module_st_hash = module_st_hash;
module_ctx->module_st_pass = module_st_pass;
module_ctx->module_tmp_size = MODULE_DEFAULT;
module_ctx->module_unstable_warning = MODULE_DEFAULT;
module_ctx->module_warmup_disable = MODULE_DEFAULT;
}
34 changes: 17 additions & 17 deletions opencl_code/m19850_a0-pure.cl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@
*/

#ifdef KERNEL_STATIC
#include "inc_vendor.h"
#include "inc_types.h"
#include "inc_platform.cl"
#include "inc_common.cl"
#include "inc_rp.h"
#include "inc_rp.cl"
#include "inc_hash_sha1.cl"
#include "inc_cipher_aes.cl"
#include "inc_scalar.cl"
#include M2S(INCLUDE_PATH/inc_vendor.h)
#include M2S(INCLUDE_PATH/inc_types.h)
#include M2S(INCLUDE_PATH/inc_platform.cl)
#include M2S(INCLUDE_PATH/inc_common.cl)
#include M2S(INCLUDE_PATH/inc_rp.h)
#include M2S(INCLUDE_PATH/inc_rp.cl)
#include M2S(INCLUDE_PATH/inc_hash_sha1.cl)
#include M2S(INCLUDE_PATH/inc_cipher_aes.cl)
#include M2S(INCLUDE_PATH/inc_scalar.cl)
#endif

DECLSPEC void crypt_derive_key_password_derivation (sha1_hmac_ctx_t *ctx, const u32 *w, const int len)
Expand Down Expand Up @@ -139,15 +139,15 @@ KERNEL_FQ void m19850_mxx (KERN_ATTR_RULES())

#endif

if (gid >= gid_max) return;
if (gid >= GID_CNT) return;

COPY_PW (pws[gid]);

/**
* loop
*/

for (u32 il_pos = 0; il_pos < il_cnt; il_pos++)
for (u32 il_pos = 0; il_pos < IL_CNT; il_pos++)
{
pw_t tmp = PASTE_PW;

Expand Down Expand Up @@ -196,7 +196,7 @@ KERNEL_FQ void m19850_sxx (KERN_ATTR_RULES())
const u64 lid = get_local_id (0);
const u64 lsz = get_local_size (0);

if (gid >= gid_max) return;
if (gid >= GID_CNT) return;

/**
* aes shared
Expand Down Expand Up @@ -251,10 +251,10 @@ KERNEL_FQ void m19850_sxx (KERN_ATTR_RULES())

const u32 search[4] =
{
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R0],
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R1],
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R2],
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R3]
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R0],
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R1],
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R2],
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R3]
};

COPY_PW (pws[gid]);
Expand All @@ -263,7 +263,7 @@ KERNEL_FQ void m19850_sxx (KERN_ATTR_RULES())
* loop
*/

for (u32 il_pos = 0; il_pos < il_cnt; il_pos++)
for (u32 il_pos = 0; il_pos < IL_CNT; il_pos++)
{
pw_t tmp = PASTE_PW;

Expand Down
34 changes: 17 additions & 17 deletions opencl_code/m19850_a1-pure.cl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@
*/

#ifdef KERNEL_STATIC
#include "inc_vendor.h"
#include "inc_types.h"
#include "inc_platform.cl"
#include "inc_common.cl"
#include "inc_rp.h"
#include "inc_rp.cl"
#include "inc_hash_sha1.cl"
#include "inc_cipher_aes.cl"
#include "inc_scalar.cl"
#include M2S(INCLUDE_PATH/inc_vendor.h)
#include M2S(INCLUDE_PATH/inc_types.h)
#include M2S(INCLUDE_PATH/inc_platform.cl)
#include M2S(INCLUDE_PATH/inc_common.cl)
#include M2S(INCLUDE_PATH/inc_rp.h)
#include M2S(INCLUDE_PATH/inc_rp.cl)
#include M2S(INCLUDE_PATH/inc_hash_sha1.cl)
#include M2S(INCLUDE_PATH/inc_cipher_aes.cl)
#include M2S(INCLUDE_PATH/inc_scalar.cl)
#endif

//CryptDeriveKey is basically sha1hmac if the input is forced to be greater than 64. Based on the code from sha1_hmac_init_vector and ipad from sha1_hmac_init_vector_64.
Expand Down Expand Up @@ -141,7 +141,7 @@ KERNEL_FQ void m19850_mxx (KERN_ATTR_BASIC())

#endif

if (gid >= gid_max) return;
if (gid >= GID_CNT) return;

//First call to sha1_update_global_utf16le_swap for the left hand side password (pws)
sha1_ctx_t tmp;
Expand All @@ -154,7 +154,7 @@ KERNEL_FQ void m19850_mxx (KERN_ATTR_BASIC())
* loop
*/

for (u32 il_pos = 0; il_pos < il_cnt; il_pos++)
for (u32 il_pos = 0; il_pos < IL_CNT; il_pos++)
{
sha1_hmac_ctx_t sha1_hmac_ctx;
sha1_ctx_t pwsorig = tmp; //Make a copy of the existing sha1_ctx_t object already calculated for pws, per loop iteration
Expand Down Expand Up @@ -252,14 +252,14 @@ KERNEL_FQ void m19850_sxx (KERN_ATTR_BASIC())

#endif

if (gid >= gid_max) return;
if (gid >= GID_CNT) return;

const u32 search[4] =
{
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R0],
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R1],
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R2],
digests_buf[DIGESTS_OFFSET].digest_buf[DGST_R3]
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R0],
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R1],
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R2],
digests_buf[DIGESTS_OFFSET_HOST].digest_buf[DGST_R3]
};

sha1_ctx_t tmp;
Expand All @@ -272,7 +272,7 @@ KERNEL_FQ void m19850_sxx (KERN_ATTR_BASIC())
* loop
*/

for (u32 il_pos = 0; il_pos < il_cnt; il_pos++)
for (u32 il_pos = 0; il_pos < IL_CNT; il_pos++)
{
sha1_hmac_ctx_t sha1_hmac_ctx;
sha1_ctx_t pwsorig = tmp;
Expand Down
Loading