Added Kerberos Hash & Fixed Base64 bug #54
Conversation
| @@ -1375,6 +1375,20 @@ class HashInfo: | |||
| ) | |||
| ], | |||
| ), | |||
| Prototype( | |||
| regex=re.compile( | |||
| r"\$krb5tgs\$23\$\*(.*)\*\$(.*)", | |||
There was a problem hiding this comment.
It looks like there are actually a couple different hash formats for Kerberos. Hashcat appears to call this one "Kerberos 5 TGS-REP etype 23".
https://hashcat.net/wiki/doku.php?id=example_hashes
Usually, these regexes are more strictly defined, we avoided .* in the past usually.
I looked at hashcat's source code and figured out how they're parsing this:
https://github.com/hashcat/hashcat/blob/master/src/modules/module_13100.c#L115-L116
(and apparently there's another compatible format $krb5tgs$23$checksum$edata2)
Here's a stricter regex that should match $krb5tgs$23$ hashes with account info.
| r"\$krb5tgs\$23\$\*(.*)\*\$(.*)", | |
| r"\$krb5tgs\$23\$\*[^*]*\*\$[a-f0-9]{32}\$[a-f0-9]{64,40960}", |
There was a problem hiding this comment.
Thanks so much for this! You're right :) We couldn't find it in HashCat, but I've made it a GitHub issue :)
Fixes #53
Fixes #52