cracker.rb

module Metasploit
  module Framework
    module PasswordCracker
      class PasswordCrackerNotFoundError < StandardError
      end

      class Cracker
        include ActiveModel::Validations

        # @!attribute attack
        #   @return [String] The attack mode for hashcat to use (not applicable to John)
        attr_accessor :attack

        # @!attribute config
        #   @return [String] The path to an optional config file for John to use
        attr_accessor :config

        # @!attribute cracker
        #   @return [String] Which cracker to use.  'john' and 'hashcat' are valid
        attr_accessor :cracker

        # @!attribute cracker_path
        #   This attribute allows the user to specify a cracker binary to use.
        #   If not supplied, the Cracker will search the PATH for a suitable john or hashcat binary
        #   and finally fall back to the pre-compiled john versions shipped with Metasploit.
        #
        #   @return [String] The file path to an alternative cracker binary to use
        attr_accessor :cracker_path

        # @!attribute format
        #   If the cracker type is john, this format will automatically be translated
        #   to the hashcat equivalent via jtr_format_to_hashcat_format
        #
        #   @return [String] The hash format to try.
        attr_accessor :format

        # @!attribute fork
        #   If the cracker type is john, the amount of forks to specify
        #
        #   @return [String] The hash format to try.
        attr_accessor :fork

        # @!attribute hash_path
        #   @return [String] The path to the file containing the hashes
        attr_accessor :hash_path

        # @!attribute incremental
        #   @return [String] The incremental mode to use
        attr_accessor :incremental

        # @!attribute increment_length
        #   @return [Array] The incremental min and max to use
        attr_accessor :increment_length

        # @!attribute mask
        #  If the cracker type is hashcat, If set, the mask to use.  Should consist of the character sets
        #  pre-defined by hashcat, such as ?d ?s ?l etc
        #
        #   @return [String] The mask to use
        attr_accessor :mask

        # @!attribute max_runtime
        #   @return [Integer] An optional maximum duration of the cracking attempt in seconds
        attr_accessor :max_runtime

        # @!attribute max_length
        #   @return [Integer] An optional maximum length of password to attempt cracking
        attr_accessor :max_length

        # @!attribute optimize
        #   @return [Boolean] If the Optimize flag should be given to Hashcat
        attr_accessor :optimize

        # @!attribute pot
        #   @return [String] The file path to an alternative John pot file to use
        attr_accessor :pot

        # @!attribute rules
        #   @return [String] The wordlist mangling rules to use inside John/Hashcat
        attr_accessor :rules

        # @!attribute wordlist
        #   @return [String] The file path to the wordlist to use
        attr_accessor :wordlist

        validates :config, 'Metasploit::Framework::File_path': true, if: -> { config.present? }

        validates :cracker, inclusion: { in: %w[john hashcat] }

        validates :cracker_path, 'Metasploit::Framework::Executable_path': true, if: -> { cracker_path.present? }

        validates :fork,
                  numericality: {
                    only_integer: true,
                    greater_than_or_equal_to: 1
                  }, if: -> { fork.present? }

        validates :hash_path, 'Metasploit::Framework::File_path': true, if: -> { hash_path.present? }

        validates :pot, 'Metasploit::Framework::File_path': true, if: -> { pot.present? }

        validates :max_runtime,
                  numericality: {
                    only_integer: true,
                    greater_than_or_equal_to: 0
                  }, if: -> { max_runtime.present? }

        validates :max_length,
                  numericality: {
                    only_integer: true,
                    greater_than_or_equal_to: 0
                  }, if: -> { max_length.present? }

        validates :wordlist, 'Metasploit::Framework::File_path': true, if: -> { wordlist.present? }

        # @param attributes [Hash{Symbol => String,nil}]
        def initialize(attributes = {})
          attributes.each do |attribute, value|
            public_send("#{attribute}=", value)
          end
        end
        
        def get_type
          self.cracker
        end

        # This method takes a {framework.db.cred.private.jtr_format} (string), and
        # returns the string number associated to the hashcat format
        #
        # @param format [String] A jtr_format string
        # @return [String] The format number for Hashcat
        def jtr_format_to_hashcat_format(format)
          case format
          # nix
          when 'md5crypt'
            '500'
          when 'descrypt'
            '1500'
          when 'bsdicrypt'
            '12400'
          when 'sha256crypt'
            '7400'
          when 'sha512crypt'
            '1800'
          when 'bcrypt'
            '3200'
          # windows
          when 'lm', 'lanman'
            '3000'
          when 'nt', 'ntlm'
            '1000'
          when 'mscash'
            '1100'
          when 'mscash2'
            '2100'
          when 'netntlm'
            '5500'
          when 'netntlmv2'
            '5600'
          # dbs
          when 'mssql'
            '131'
          when 'mssql05'
            '132'
          when 'mssql12'
            '1731'
          # hashcat requires a format we dont have all the data for
          # in the current dumper, so this is disabled in module and lib
          # when 'oracle', 'des,oracle'
          #  return '3100'
          when 'oracle11', 'raw-sha1,oracle'
            '112'
          when 'oracle12c', 'pbkdf2,oracle12c'
            '12300'
          when 'postgres', 'dynamic_1034', 'raw-md5,postgres'
            '12'
          when 'mysql'
            '200'
          when 'mysql-sha1'
            '300'
          when 'PBKDF2-HMAC-SHA512' # osx 10.8+
            '7100'
          # osx
          when 'xsha' # osx 10.4-6
            '122'
          when 'xsha512' # osx 10.7
            '1722'
          # webapps
          when 'PBKDF2-HMAC-SHA1' # Atlassian
            '12001'
          when 'phpass' # Wordpress/PHPass, Joomla, phpBB3
            '400'
          when 'mediawiki' # mediawiki b type
            '3711'
          # mobile
          when 'android-samsung-sha1'
            '5800'
          when 'android-sha1'
            '110'
          when 'android-md5'
            '10'
          when 'hmac-md5'
            '10200'
          when 'dynamic_82'
            '1710'
          when 'ssha'
            '111'
          when 'raw-sha512'
            '1700'
          when 'raw-sha256'
            '1400'
          when 'raw-sha1'
            '100'
          when 'raw-md5'
            '0'
          when 'smd5'
            '6300'
          when 'ssha256'
            '1411'
          when 'ssha512'
            '1711'
          when 'Raw-MD5u'
            '30'
          when 'pbkdf2-sha256'
            '10900'
          end
        end

        # This method sets the appropriate parameters to run a cracker in incremental mode
        def mode_incremental
          self.increment_length = nil
          self.wordlist = nil
          self.mask = nil
          self.max_runtime = nil
          if cracker == 'john'
            self.rules = nil
            self.incremental = 'Digits'
          elsif cracker == 'hashcat'
            self.attack = '3'
            self.incremental = true
          end
        end

        # This method sets the appropriate parameters to run a cracker in wordlist mode
        #
        # @param file [String] A file location of the wordlist to use
        def mode_wordlist(file)
          self.increment_length = nil
          self.incremental = nil
          self.max_runtime = nil
          self.mask = nil
          if cracker == 'john'
            self.wordlist = file
            self.rules = 'wordlist'
          elsif cracker == 'hashcat'
            self.wordlist = file
            self.attack = '0'
          end
        end

        # This method sets the appropriate parameters to run a cracker in a pin mode (4-8 digits) on hashcat
        def mode_pin
          self.rules = nil
          if cracker == 'hashcat'
            self.attack = '3'
            self.mask = '?d' * 8
            self.incremental = true
            self.increment_length = [4, 8]
            self.max_runtime = 300 # 5min on an i7 got through 4-7 digits. 8digit was 32min more
          end
        end

        # This method sets the john to 'normal' mode
        def mode_normal
          if cracker == 'john'
            self.max_runtime = nil
            self.mask = nil
            self.wordlist = nil
            self.rules = nil
            self.incremental = nil
            self.increment_length = nil
          end
        end

        # This method sets the john to single mode
        #
        # @param file [String] A file location of the wordlist to use
        def mode_single(file)
          if cracker == 'john'
            self.wordlist = file
            self.rules = 'single'
            self.incremental = nil
            self.increment_length = nil
            self.mask = nil
          end
        end

        # This method follows a decision tree to determine the path
        # to the cracker binary we should use.
        #
        # @return [String, NilClass] Returns Nil if a binary path could not be found, or a String containing the path to the selected JTR binary on success.
        def binary_path
          # Always prefer a manually entered path
          if cracker_path && ::File.file?(cracker_path)
            return cracker_path
          else
            case cracker
            when 'hashcat'
              path = get_hashcat
            when 'john'
              path = get_john
            when 'auto'
              path = get_john || get_hashcat
            else
              raise PasswordCrackerNotFoundError, 'No suitable Cracker was selected, so a binary could not be found on the system JOHN || HASHCAT'
            end
            raise PasswordCrackerNotFoundError, 'No suitable john/hashcat binary was found on the system' unless path && ::File.file?(path)

            return path
          end
        end

        # This method runs the command from {#crack_command} and yields each line of output.
        #
        # @yield [String] a line of output from the cracker command
        # @return [void]
        def crack(&block)
          if cracker == 'john'
            results = john_crack_command
          elsif cracker == 'hashcat'
            results = hashcat_crack_command
          end
          ::IO.popen(results, 'rb') do |fd|
            fd.each_line(&block)
          end
        end

        # This method returns the version of John the Ripper or Hashcat being used.
        #
        # @raise [PasswordCrackerNotFoundError] if a suitable cracker binary was never found
        # @return [String] the version detected
        def cracker_version
          if cracker == 'john'
            cmd = binary_path
          elsif cracker == 'hashcat'
            cmd = binary_path
            cmd << (' -V')
          end
          ::IO.popen(cmd, 'rb') do |fd|
            fd.each_line do |line|
              if cracker == 'john'
                # John the Ripper 1.8.0.13-jumbo-1-bleeding-973a245b96 2018-12-17 20:12:51 +0100 OMP [linux-gnu 64-bit x86_64 AVX2 AC]
                # John the Ripper 1.9.0-jumbo-1 OMP [linux-gnu 64-bit x86_64 AVX2 AC]
                # John the Ripper password cracker, version 1.8.0.2-bleeding-jumbo_omp [64-bit AVX-autoconf]
                # John the Ripper password cracker, version 1.8.0
                return Regexp.last_match(1).strip if line =~ /John the Ripper(?: password cracker, version)? ([^\[]+)/
              elsif cracker == 'hashcat'
                # v5.1.0
                return Regexp.last_match(1) if line =~ /(v[\d.]+)/
              end
            end
          end
          nil
        end

        # This method is used to determine which format of the no log option should be used
        # --no-log vs --nolog https://github.com/openwall/john/commit/8982e4f7a2e874aab29807a05b421373015c9b61
        # We base this either on a date being in the version, or running the command and checking the output
        #
        # @return [String] The nolog format to use
        def john_nolog_format
          if /(\d{4}-\d{2}-\d{2})/ =~ cracker_version
            # we lucked out and theres a date, we'll check its older than the commit that changed the nolog
            if Date.parse(Regexp.last_match(1)) < Date.parse('2020-11-27')
              return '--nolog'
            end

            return '--no-log'
          end

          # no date, so lets give it a run with the old format and check if we raise an error
          # on *nix 'unknown option' goes to stderr
          ::IO.popen([binary_path, '--nolog', { err: %i[child out] }], 'rb') do |fd|
            return '--nolog' unless fd.read.include? 'Unknown option'
          end
          '--no-log'
        end

        # This method builds an array for the command to actually run the cracker.
        # It builds the command from all of the attributes on the class.
        #
        # @raise [PasswordCrackerNotFoundError] if a suitable John binary was never found
        # @return [Array] An array set up for {::IO.popen} to use
        def john_crack_command
          cmd_string = binary_path

          cmd = [cmd_string, '--session=' + cracker_session_id, john_nolog_format]

          if config.present?
            cmd << ('--config=' + config)
          else
            cmd << ('--config=' + john_config_file)
          end

          if pot.present?
            cmd << ('--pot=' + pot)
          else
            cmd << ('--pot=' + john_pot_file)
          end

          if fork.present? && fork > 1
            cmd << ('--fork=' + fork.to_s)
          end

          if format.present?
            cmd << ('--format=' + format)
          end

          if wordlist.present?
            cmd << ('--wordlist=' + wordlist)
          end

          if incremental.present?
            cmd << ('--incremental=' + incremental)
          end

          if rules.present?
            cmd << ('--rules=' + rules)
          end

          if max_runtime.present?
            cmd << ('--max-run-time=' + max_runtime.to_s)
          end

          if max_length.present?
            cmd << ('--max-len=' + max_length.to_s)
          end

          cmd << hash_path
        end

        # This method builds an array for the command to actually run the cracker.
        # It builds the command from all of the attributes on the class.
        #
        # @raise [PasswordCrackerNotFoundError] if a suitable Hashcat binary was never found
        # @return [Array] An array set up for {::IO.popen} to use
        def hashcat_crack_command
          cmd_string = binary_path
          cmd = [cmd_string, '--session=' + cracker_session_id, '--logfile-disable', '--quiet', '--username']

          if pot.present?
            cmd << ('--potfile-path=' + pot)
          else
            cmd << ('--potfile-path=' + john_pot_file)
          end

          if format.present?
            cmd << ('--hash-type=' + jtr_format_to_hashcat_format(format))
          end

          if optimize.present?
            # https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#what_is_the_maximum_supported_password_length_for_optimized_kernels
            # Optimized Kernels has a large impact on speed.  Here are some stats from Hashcat 5.1.0:

            # Kali Linux on Dell Precision M3800
            ## hashcat -b -w 2 -m 0
            # * Device #1: Quadro K1100M, 500/2002 MB allocatable, 2MCU
            # Speed.#1.........:   185.9 MH/s (11.15ms) @ Accel:64 Loops:16 Thr:1024 Vec:1

            ## hashcat -b -w 2 -O -m 0
            # * Device #1: Quadro K1100M, 500/2002 MB allocatable, 2MCU
            # Speed.#1.........:   463.6 MH/s (8.92ms) @ Accel:64 Loops:32 Thr:1024 Vec:1

            # Windows 10
            # PS C:\hashcat-5.1.0> .\hashcat64.exe -b -O -w 2 -m 0
            # * Device #1: GeForce RTX 2070 SUPER, 2048/8192 MB allocatable, 40MCU
            # Speed.#1.........: 13914.0 MH/s (5.77ms) @ Accel:128 Loops:64 Thr:256 Vec:1

            # PS C:\hashcat-5.1.0> .\hashcat64.exe -b -O -w 2 -m 0
            # * Device #1: GeForce RTX 2070 SUPER, 2048/8192 MB allocatable, 40MCU
            # Speed.#1.........: 31545.6 MH/s (10.36ms) @ Accel:256 Loops:128 Thr:256 Vec:1

            # This change should result in 225%-250% speed boost at the sacrifice of some password length, which most likely
            # wouldn't be tested inside of MSF since most users are using the MSF modules for word list and easy cracks.
            # Anything of length where this would cut off is most likely being done independently (outside MSF)

            cmd << ('-O')
          end

          if incremental.present?
            cmd << ('--increment')
            if increment_length.present?
              cmd << ('--increment-min=' + increment_length[0].to_s)
              cmd << ('--increment-max=' + increment_length[1].to_s)
            else
              # anything more than max 4 on even des took 8+min on an i7.
              # maybe in the future this can be adjusted or made a variable
              # but current time, we'll leave it as this seems like reasonable
              # time expectation for a module to run
              cmd << ('--increment-max=4')
            end
          end

          if rules.present?
            cmd << ('--rules-file=' + rules)
          end

          if attack.present?
            cmd << ('--attack-mode=' + attack)
          end

          if max_runtime.present?
            cmd << ('--runtime=' + max_runtime.to_s)
          end

          cmd << hash_path

          if mask.present?
            cmd << mask.to_s
          end

          # must be last
          if wordlist.present?
            cmd << (wordlist)
          end
          cmd
        end

        # This runs the show command in john and yields cracked passwords.
        #
        # @return [Array] the output from the command split on newlines
        def each_cracked_password
          ::IO.popen(show_command, 'rb').readlines
        end

        # This method returns the path to a default john.conf file.
        #
        # @return [String] the path to the default john.conf file
        def john_config_file
          ::File.join(::Msf::Config.data_directory, 'jtr', 'john.conf')
        end

        # This method returns the path to a default john.pot file.
        #
        # @return [String] the path to the default john.pot file
        def john_pot_file
          ::File.join(::Msf::Config.config_directory, 'john.pot')
        end

        # This method is a getter for a random Session ID for the cracker.
        # It allows us to dinstiguish between cracking sessions.
        #
        # @ return [String] the Session ID to use
        def cracker_session_id
          @session_id ||= ::Rex::Text.rand_text_alphanumeric(8)
        end

        # This method builds the command to show the cracked passwords.
        #
        # @raise [JohnNotFoundError] if a suitable John binary was never found
        # @return [Array] An array set up for {::IO.popen} to use
        def show_command
          cmd_string = binary_path

          pot_file = pot || john_pot_file
          if cracker == 'hashcat'
            cmd = [cmd_string, '--show', '--username', "--potfile-path=#{pot_file}", "--hash-type=#{jtr_format_to_hashcat_format(format)}"]
          elsif cracker == 'john'
            cmd = [cmd_string, '--show', "--pot=#{pot_file}", "--format=#{format}"]

            if config
              cmd << "--config=#{config}"
            else
              cmd << ('--config=' + john_config_file)
            end
          end
          cmd << hash_path
        end
        
        def get_hashcat
          # Look in the Environment PATH for the hashcat binary
          self.cracker = 'hashcat'
          Rex::FileUtils.find_full_path('hashcat') ||
            Rex::FileUtils.find_full_path('hashcat.exe')
        end

        def get_john
          self.cracker = 'john'
          # Look in the Environment PATH for the john binary
          Rex::FileUtils.find_full_path('john') ||
            Rex::FileUtils.find_full_path('john.exe')
        end

      end
    end
  end
end