/
jtr_oracle_fast.rb
107 lines (95 loc) · 3.61 KB
/
jtr_oracle_fast.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core/auxiliary/jtr'
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::JohnTheRipper
def initialize
super(
'Name' => 'John the Ripper Oracle Password Cracker (Fast Mode)',
'Description' => %Q{
This module uses John the Ripper to identify weak passwords that have been
acquired from the oracle_hashdump module. Passwords that have been successfully
cracked are then saved as proper credentials.
},
'Author' =>
[
'theLightCosine',
'hdm'
] ,
'License' => MSF_LICENSE # JtR itself is GPLv2, but this wrapper is MSF (BSD)
)
end
def run
cracker = new_john_cracker
# generate our wordlist and close the file handle
wordlist = wordlist_file
wordlist.close
print_status "Wordlist file written out to #{wordlist.path}"
cracker.wordlist = wordlist.path
cleanup_files = [wordlist.path]
# dynamic_1506 is oracle 11/12's H field, MD5.
['oracle', 'dynamic_1506', 'oracle11', 'oracle12c'].each do |format|
cracker_instance = cracker.dup
cracker_instance.format = format
case format
when 'oracle'
cracker_instance.hash_path = hash_file('des|oracle')
cleanup_files << cracker_instance.hash_path
when 'dynamic_1506'
cracker_instance.hash_path = hash_file('raw-sha1|oracle11|oracle12c|dynamic_1506')
cleanup_files << cracker_instance.hash_path
when 'oracle11'
cracker_instance.hash_path = hash_file('raw-sha1|oracle11')
cleanup_files << cracker_instance.hash_path
when 'oracle12c'
cracker_instance.hash_path = hash_file('oracle12c')
cleanup_files << cracker_instance.hash_path
end
print_status "Cracking #{format} hashes in normal wordlist mode..."
# Turn on KoreLogic rules if the user asked for it
if datastore['KORELOGIC']
cracker_instance.rules = 'KoreLogicRules'
print_status "Applying KoreLogic ruleset..."
end
cracker_instance.crack do |line|
vprint_status line.chomp
end
print_status "Cracking #{format} hashes in single mode..."
cracker_instance.rules = 'single'
cracker_instance.crack do |line|
vprint_status line.chomp
end
print_status "Cracked passwords this run:"
cracker_instance.each_cracked_password do |password_line|
password_line.chomp!
next if password_line.blank?
fields = password_line.split(":")
# If we don't have an expected minimum number of fields, this is probably not a hash line
next unless fields.count >=3
username = fields.shift
core_id = fields.pop
password = fields.join(':') # Anything left must be the password. This accounts for passwords with : in them
print_good "#{username}:#{password}"
create_cracked_credential( username: username, password: password, core_id: core_id)
end
end
if datastore['DeleteTempFiles']
cleanup_files.each do |f|
File.delete(f)
end
end
end
def hash_file(format)
hashlist = Rex::Quickfile.new("hashes_tmp")
framework.db.creds(workspace: myworkspace, type: 'Metasploit::Credential::NonreplayableHash').each do |core|
if core.private.jtr_format =~ /#{format}/
hashlist.puts hash_to_jtr(core)
end
end
hashlist.close
print_status "Hashes Written out to #{hashlist.path}"
hashlist.path
end
end