Refactor OSX hashdump post module and add support for 10.8+ hashes #2735
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Adds support for MATCHUSER regex option * Adds support for OSX 10.8 and 10.9 hashes (PBKDF2) * DRYs up a bunch of older code, adds lots of helper fns * Ends up shaving off ~20 lines
* Also add spacing and indentation for better readability. * Refactors grab_shadow_blob method.
|
Processing... |
|
Tested successfully on mavericks: @jvennix-r7 were you able to test on 10.6 / 10.7, I haven't 10.6/10.7 available to test. So if you did and could provide output, will be enough to me to land :) |
|
|
||
| # Check if NT HASH is present | ||
| if hash_decoded =~ /4F1010/ | ||
| report_nt_hash(hash_decoded.scan(/^\w*4F1010(\w*)4F1044/)[0][0]) |
There was a problem hiding this comment.
I miss a second argument for report_nt_hash
|
@jvazquez-r7 sure I'll test on those later today |
|
@kgray-r7 is going to verify 10.6 and 10.8, I'll re-verify 10.7 later |
|
Found a bug in 10.5/6, fixed and verified working: |
|
Working well in 10.7: |
|
Thanks @jvennix-r7 and @kgray-r7 , proceeding with landing! |
jvazquez-r7
added a commit
that referenced
this pull request
Dec 10, 2013
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Note that the
enum_osxpost module duplicates the functionality for hashdump. I am purposefully not updating the duplicate, as this is a bad pattern, and I am in the middle of refactoring enum_osx anyways (branch name refactor_osx_enum).Verification steps:
MATCHUSERSdatastore option works as expectedIn each instance, verify that the dumped hash is identical to what Dave Grohl outputs with this command: