Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::PasswordCracker
8

9
  def initialize
10
    super(
11
      'Name' => 'Password Cracker: OSX',
12
      'Description' => %(
13
          This module uses John the Ripper or Hashcat to identify weak passwords that have been
14
        acquired from OSX systems. The module will only crack xsha from OSX 10.4-10.6, xsha512
15
        from 10.7, and PBKDF2 from OSX 10.8+.
16
        XSHA is 122 in hashcat.
17
        XSHA512 is 1722 in hashcat.
18
        PBKDF2 (PBKDF2-HMAC-SHA512) is 7100 in hashcat.
19
      ),
20
      'Author' => [
21
        'h00die' # hashcat integration
22
      ],
23
      'License' => MSF_LICENSE, # JtR itself is GPLv2, but this wrapper is MSF (BSD)
24
      'Actions' => [
25
        ['john', { 'Description' => 'Use John the Ripper' }],
26
        ['hashcat', { 'Description' => 'Use Hashcat' }],
27
      ],
28
      'DefaultAction' => 'john',
29
    )
30

31
    register_options(
32
      [
33
        OptBool.new('XSHA', [false, 'Include XSHA hashes from 10.4-10.6', true]),
34
        OptBool.new('XSHA512', [false, 'Include XSHA512 hashes from 10.7', true]),
35
        OptBool.new('PBKDF2', [false, 'Include PBKDF2-HMAC-SHA512 hashes from 10.8+', true]),
36
        OptBool.new('INCREMENTAL', [false, 'Run in incremental mode', true]),
37
        OptBool.new('WORDLIST', [false, 'Run in wordlist mode', true])
38
      ]
39
    )
40
  end
41

42
  def show_command(cracker_instance)
43
    return unless datastore['ShowCommand']
44

45
    if action.name == 'john'
46
      cmd = cracker_instance.john_crack_command
47
    elsif action.name == 'hashcat'
48
      cmd = cracker_instance.hashcat_crack_command
49
    end
50
    print_status("   Cracking Command: #{cmd.join(' ')}")
51
  end
52

53
  def run
54
    def check_results(passwords, results, hash_type, method)
55
      passwords.each do |password_line|
56
        password_line.chomp!
57
        next if password_line.blank?
58

59
        fields = password_line.split(':')
60
        cred = { 'hash_type' => hash_type, 'method' => method }
61
        # If we don't have an expected minimum number of fields, this is probably not a hash line
62
        if action.name == 'john'
63
          next unless fields.count >= 3
64

65
          cred['username'] = fields.shift
66
          cred['core_id'] = fields.pop
67
          unless hash_type == 'PBKDF2-HMAC-SHA512'
68
            4.times { fields.pop } # Get rid of extra :
69
          end
70
          cred['password'] = fields.join(':') # Anything left must be the password. This accounts for passwords with semi-colons in it
71
        elsif action.name == 'hashcat'
72
          next unless fields.count >= 3
73

74
          cred['core_id'] = fields.shift
75
          cred['hash'] = fields.shift
76
          cred['password'] = fields.join(':') # Anything left must be the password. This accounts for passwords with semi-colons in it
77
          next if cred['core_id'].include?("Hashfile '") && cred['core_id'].include?("' on line ") # skip error lines
78

79
          # we don't have the username since we overloaded it with the core_id (since its a better fit for us)
80
          # so we can now just go grab the username from the DB
81
          cred['username'] = framework.db.creds(workspace: myworkspace, id: cred['core_id'])[0].public.username
82
        end
83
        results = process_cracker_results(results, cred)
84
      end
85
      results
86
    end
87

88
    tbl = tbl = cracker_results_table
89

90
    # array of hashes in jtr_format in the db, converted to an OR combined regex
91
    hash_types_to_crack = []
92
    hash_types_to_crack << 'xsha' if datastore['XSHA']
93
    hash_types_to_crack << 'xsha512' if datastore['XSHA512']
94
    hash_types_to_crack << 'PBKDF2-HMAC-SHA512' if datastore['PBKDF2']
95
    jobs_to_do = []
96

97
    # build our job list
98
    hash_types_to_crack.each do |hash_type|
99
      job = hash_job(hash_type, action.name)
100
      if job.nil?
101
        print_status("No #{hash_type} found to crack")
102
      else
103
        jobs_to_do << job
104
      end
105
    end
106

107
    # bail early of no jobs to do
108
    if jobs_to_do.empty?
109
      print_good("No uncracked password hashes found for: #{hash_types_to_crack.join(', ')}")
110
      return
111
    end
112

113
    # array of arrays for cracked passwords.
114
    # Inner array format: db_id, hash_type, username, password, method_of_crack
115
    results = []
116

117
    cracker = new_password_cracker(action.name)
118

119
    # generate our wordlist and close the file handle.
120
    wordlist = wordlist_file
121
    unless wordlist
122
      print_error('This module cannot run without a database connected. Use db_connect to connect to a database.')
123
      return
124
    end
125

126
    wordlist.close
127
    print_status "Wordlist file written out to #{wordlist.path}"
128

129
    cleanup_files = [wordlist.path]
130

131
    jobs_to_do.each do |job|
132
      format = job['type']
133
      hash_file = Rex::Quickfile.new("hashes_#{job['type']}_")
134
      hash_file.puts job['formatted_hashlist']
135
      hash_file.close
136
      cracker.hash_path = hash_file.path
137
      cleanup_files << hash_file.path
138
      # dupe our original cracker so we can safely change options between each run
139
      cracker_instance = cracker.dup
140
      cracker_instance.format = format
141
      if action.name == 'john'
142
        cracker_instance.fork = datastore['FORK']
143
      end
144

145
      # first check if anything has already been cracked so we don't report it incorrectly
146
      print_status "Checking #{format} hashes already cracked..."
147
      results = check_results(cracker_instance.each_cracked_password, results, format, 'Already Cracked/POT')
148
      vprint_good(append_results(tbl, results)) unless results.empty?
149

150
      if action.name == 'john'
151
        print_status "Cracking #{format} hashes in single mode..."
152
        cracker_instance.mode_single(wordlist.path)
153
        show_command cracker_instance
154
        cracker_instance.crack do |line|
155
          vprint_status line.chomp
156
        end
157
        results = check_results(cracker_instance.each_cracked_password, results, format, 'Single')
158
        vprint_good(append_results(tbl, results)) unless results.empty?
159
        job['cred_ids_left_to_crack'] = job['cred_ids_left_to_crack'] - results.map { |i| i[0].to_i } # remove cracked hashes from the hash list
160
        next if job['cred_ids_left_to_crack'].empty?
161

162
        print_status "Cracking #{format} hashes in normal mode..."
163
        cracker_instance.mode_normal
164
        show_command cracker_instance
165
        cracker_instance.crack do |line|
166
          vprint_status line.chomp
167
        end
168
        results = check_results(cracker_instance.each_cracked_password, results, format, 'Normal')
169
        vprint_good(append_results(tbl, results)) unless results.empty?
170
        job['cred_ids_left_to_crack'] = job['cred_ids_left_to_crack'] - results.map { |i| i[0].to_i } # remove cracked hashes from the hash list
171
        next if job['cred_ids_left_to_crack'].empty?
172
      end
173

174
      if datastore['INCREMENTAL']
175
        print_status "Cracking #{format} hashes in incremental mode..."
176
        cracker_instance.mode_incremental
177
        show_command cracker_instance
178
        cracker_instance.crack do |line|
179
          vprint_status line.chomp
180
        end
181
        results = check_results(cracker_instance.each_cracked_password, results, format, 'Incremental')
182
        vprint_good(append_results(tbl, results)) unless results.empty?
183
        job['cred_ids_left_to_crack'] = job['cred_ids_left_to_crack'] - results.map { |i| i[0].to_i } # remove cracked hashes from the hash list
184
        next if job['cred_ids_left_to_crack'].empty?
185
      end
186

187
      if datastore['WORDLIST']
188
        print_status "Cracking #{format} hashes in wordlist mode..."
189
        cracker_instance.mode_wordlist(wordlist.path)
190
        # Turn on KoreLogic rules if the user asked for it
191
        if action.name == 'john' && datastore['KORELOGIC']
192
          cracker_instance.rules = 'KoreLogicRules'
193
          print_status 'Applying KoreLogic ruleset...'
194
        end
195
        show_command cracker_instance
196
        cracker_instance.crack do |line|
197
          vprint_status line.chomp
198
        end
199

200
        results = check_results(cracker_instance.each_cracked_password, results, format, 'Wordlist')
201
        vprint_good(append_results(tbl, results)) unless results.empty?
202
        job['cred_ids_left_to_crack'] = job['cred_ids_left_to_crack'] - results.map { |i| i[0].to_i } # remove cracked hashes from the hash list
203
        next if job['cred_ids_left_to_crack'].empty?
204
      end
205

206
      # give a final print of results
207
      print_good(append_results(tbl, results))
208
    end
209
    if datastore['DeleteTempFiles']
210
      cleanup_files.each do |f|
211
        File.delete(f)
212
      end
213
    end
214
  end
215
end
216

217