infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add osx to hash identify

master
h00die 2019-04-14 10:12:26 -04:00
parent 75ac760d18
commit dcc1a21251
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/metasploit/framework/hashes/identify.rb
View File

@ -42,8 +42,13 @@ def identify_hash(hash)
# windows # windows
when hash.length == 65 && hash =~ /^[\da-fA-F]{32}:[\da-fA-F]{32}$/ && hash.split(':').first.upcase == 'AAD3B435B51404EEAAD3B435B51404EE' when hash.length == 65 && hash =~ /^[\da-fA-F]{32}:[\da-fA-F]{32}$/ && hash.split(':').first.upcase == 'AAD3B435B51404EEAAD3B435B51404EE'
return 'nt' return 'nt'
when hash.length == 65 && hash =~ /^[0-9a-fA-F]{32}:[0-9a-fA-F]{32}$/ when hash.length == 65 && hash =~ /^[\da-fA-F]{32}:[\da-fA-F]{32}$/
return 'lm' return 'lm'
# OSX
when hash.start_with?('$ml$') && hash.split('$').last.length == 256
return 'pbkdf2-hmac-sha512,osx' # 10.8+
when hash =~ /^[\da-fA-F]{48}$/ # hash.length == 48
return 'xsha,osx' # 10.4-10.6
# databases # databases
when hash.start_with?('0x0100') && hash.length == 54 when hash.start_with?('0x0100') && hash.length == 54
return 'mssql05' return 'mssql05'

14
spec/lib/metasploit/framework/hashes/identify_spec.rb
View File

@ -119,6 +119,20 @@ RSpec.describe 'hashes/identify' do
end end
end end
describe 'identify_pbkdf2_osx' do
it 'returns pbkdf2-hmac-sha512,osx' do
hash = identify_hash('$ml$49504$0dba6246bd38266b2e827ff7e7271380757c71d653893aa361d5902398302369$c5f198639915a101c99af326dffe13e8f14456be8fd2312a39a777b92178804e204ca4fee12a8667871440eff4288e811d86d746c6d96a60c919c3418dfebba42f329f5d73c0372d636d61d5dfda1add61af36c70e4acd771276107209e643ae92a0f43e95a452744e50fb4540d9bdf4e0b701725d7db488fbe18c1ab7737c6b')
expect(hash).to match ('pbkdf2-hmac-sha512,osx')
end
end
describe 'identify_sha_osx' do
it 'returns xsha,osx' do
hash = identify_hash('1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683')
expect(hash).to match ('xsha,osx')
end
end
describe 'identify_mssql05' do describe 'identify_mssql05' do
it 'returns mssql05' do it 'returns mssql05' do
hash = identify_hash('0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908') hash = identify_hash('0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908')