Page 1 of 2

Oracle (10G and lower) Hash Support?

PostPosted: Wed Feb 29, 2012 6:09 pm
by aliby
Hey there,

Was curious if you had considered adding support for Oracle hashes (10g and lower)? The hash format is: DES($salt.$pass), where $salt = the account name/username.

Thanks!

Re: Oracle (10G and lower) Hash Support?

PostPosted: Wed Feb 29, 2012 8:38 pm
by Bitweasil
DES takes a 56 bit input...

Can you provide me a link to an implementation or details?

Re: Oracle (10G and lower) Hash Support?

PostPosted: Wed Feb 29, 2012 8:58 pm
by aliby
Whoops, may have spoke too soon/misunderstood, but here goes:

http://www.red-database-security.com/wh ... words.html

And to quote/paraphrase this post: http://groups.google.com/group/comp.dat ... 7a977fb6ed

Implementation:
1. Upshift password, convert to 16bits per character, and place result left justified in an 80 byte array of zeros.
2. Using DES in cipher block feedback mode compute the CBC checksum for the 80 byte password array using a fixed secret password (you can find it in the code if you look hard enough). The result is used as the key for the next step ignoring parity bits to produce the a 56 bit key from the CBC.
3. Upshift password, and convert to 16bits per character, and place result left justified in an 80 byte array of zeros.
4. Using DES in cipher block feedback mode compute the CBC checksum for the 80 byte username array using the key generate in step 2.
5. Convert the CBC checksum from step 4 into a printable string with the obvious algorithm.


And a few more resources:

http://jchblue.blogspot.com/2010/04/ora ... rithm.html
http://freeworld.thc.org/papers/thc-orakelsniffert.pdf

Re: Oracle (10G and lower) Hash Support?

PostPosted: Wed Feb 29, 2012 10:38 pm
by Bitweasil
Eewwww...

Yeah, I'll see what I can hammer out. Some working C source would be quite useful if you had time to write it up.

Re: Oracle (10G and lower) Hash Support?

PostPosted: Thu Mar 01, 2012 12:10 am
by Sc00bz
This might help it has working php code although I cheated by using mcrypt_encrypt(MCRYPT_DES, ..., 'cbc', ...)

http://www.tobtu.com/oracle.php

Re: Oracle (10G and lower) Hash Support?

PostPosted: Thu Mar 01, 2012 2:53 pm
by aliby
Thanks Sc00bz for the code and Bitweasil for trying to implement it :)

Oh, also, apparently HashKill has support for what they call "oracle-old," which is the 10G and lower algorithim. Latest source is available here: http://www.gat3way.eu/hashkill/index.php?page=download. I've attached the source of the oracle-old plugin, in case it might help.

Unfortunately I don't have a CUDA enabled Linux box at the moment, and I can't seem to get HashKill to compile on my Mac. Oh, that, and I just like the Cryptohaze-Multiforcer better :-p

Thanks guys!

Re: Oracle (10G and lower) Hash Support?

PostPosted: Thu Mar 01, 2012 3:26 pm
by Bitweasil
Sweet. I'll see what I can do with it once I get the framework a bit better sorted out. :)

Re: Oracle (10G and lower) Hash Support?

PostPosted: Wed Mar 07, 2012 8:57 pm
by aliby
So, after finally getting around to configuring Backtrack on a Linux box with an NVIDIA card in it, I realized/found out that hashkill does NOT in fact use CUDA for the oracle-old plugin. It ends up using the CPU instead.

So, if you could implement this, that would be awesome (as I've got a nice list of Oracle hashes sitting here that need breaking...)

Thanks! :)

Re: Oracle (10G and lower) Hash Support?

PostPosted: Thu Mar 08, 2012 5:32 am
by Bitweasil
What file format do you have them in?

It looks like it should be fairly straightforward to implement. I've got a DES engine.

Re: Oracle (10G and lower) Hash Support?

PostPosted: Thu Mar 08, 2012 12:37 pm
by aliby
Currently they're set up as $username:$hash (which in Oracle's hashing algorithm means $salt:$hash) in a text file. Fortunately, with CPU-based hybrid dictionary and markov attacks, I have gotten 32% of the passwords cracked so far (using a combination of PasswordsPro and Hashkill).

I would love to increase that percentage using some GPU power :)