Skip to content

Commit

Permalink
Merge pull request #107 from amadejpapez/main
Browse files Browse the repository at this point in the history 
Added 10 new hash types - PDF, 7-zip, SecureZIP
  • Loading branch information
@Jayy001
Jayy001 committed May 19, 2021
2 parents 65dc6a1 + 001d0ff commit 2c3ad25
Show file tree
Hide file tree
Showing 2 changed files with 169 additions and 1 deletion.
105 changes: 105 additions & 0 deletions name_that_hash/hashes.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1555,6 +1555,34 @@ class HashInfo:
)
],
),
Prototype(
regex=re.compile(r"\$pdf\$1\*[2|3]\*[0-9]{2}\*[-0-9]{1,6}\*[0-9]\*[0-9]{2}\*[a-f0-9]{32,32}\*[0-9]{2}\*[a-f0-9]{64}\*[0-9]{2}\*[a-f0-9]{64}", re.IGNORECASE),
modes=[
HashInfo(
name="PDF 1.1 - 1.3 (Acrobat 2 - 4)",
hashcat=10400,
john="pdf",
extended=False,
),
HashInfo(
name="PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1",
hashcat=10410,
john="pdf",
extended=False,
),
],
),
Prototype(
regex=re.compile(r"\$pdf\$1\*[2|3]\*[0-9]{2}\*[-0-9]{1,6}\*[0-9]\*[0-9]{2}\*[a-f0-9]{32}\*[0-9]{2}\*[a-f0-9]{64}\*[0-9]{2}\*[a-f0-9]{64}:[a-f0-9]{10}", re.IGNORECASE),
modes=[
HashInfo(
name="PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2",
hashcat=10420,
john=None,
extended=False,
),
],
),
Prototype(
regex=re.compile(
r"^\$pdf\$[24]\*[34]\*128\*[0-9-]{1,5}\*1\*(16|32)\*[a-f0-9]{32,64}\*32\*[a-f0-9]{64}\*(8|16|32)\*[a-f0-9]{16,64}$",
Expand All @@ -1569,6 +1597,28 @@ class HashInfo:
)
],
),
Prototype(
regex=re.compile(r"\$pdf\$5\*[5|6]\*[0-9]{3}\*[-0-9]{1,6}\*[0-9]\*[0-9]{1,4}\*[a-f0-9]{0,1024}\*[0-9]{1,4}\*[a-f0-9]{0,1024}\*[0-9]{1,4}\*[a-f0-9]{0,1024}\*[0-9]{1,4}\*[a-f0-9]{0,1024}\*[0-9]{1,4}\*[a-f0-9]{0,1024}", re.IGNORECASE),
modes=[
HashInfo(
name="PDF 1.7 Level 3 (Acrobat 9)",
hashcat=10600,
john="pdf",
extended=False,
),
],
),
Prototype(
regex=re.compile(r"\$pdf\$5\*[5|6]\*[0-9]{3}\*[-0-9]{1,6}\*[0-9]\*[0-9]{1,4}\*[a-f0-9]{0,1024}\*[0-9]{1,4}\*[a-f0-9]{0,1024}\*[0-9]{1,4}\*[a-f0-9]{0,1024}", re.IGNORECASE),
modes=[
HashInfo(
name="PDF 1.7 Level 8 (Acrobat 10 - 11)",
hashcat=10700,
john="pdf",
extended=False,
),
],
),
Prototype(
regex=re.compile(r"^\$krb5asrep\$23\$[^:]+:[a-f0-9]{32,32}\$[a-f0-9]{64,40960}$", re.IGNORECASE),
modes=[
Expand Down Expand Up @@ -1807,4 +1857,59 @@ class HashInfo:
),
],
),
Prototype(
regex=re.compile(r"\$7z\$[0-9]\$[0-9]{1,2}\$[0-9]{1}\$[^$]{0,64}\$[0-9]{1,2}\$[a-f0-9]{32}\$[0-9]{1,10}\$[0-9]{1,6}\$[0-9]{1,6}\$[a-f0-9]{2,}", re.IGNORECASE),
modes=[
HashInfo(
name="7-zip",
hashcat=11600,
john="7z",
extended=False,
),
],
),
Prototype(
regex=re.compile(r"\$zip3\$\*[0-9]\*[0-9]\*256\*[0-9]\*[a-f0-9]{0,32}\*[a-f0-9]{288}\*[0-9]\*[0-9]\*[0-9]\*[^\s]{0,64}", re.IGNORECASE),
modes=[
HashInfo(
name="SecureZIP AES-256",
hashcat=23003,
john="securezip",
extended=False,
),
],
),
Prototype(
regex=re.compile(r"\$zip3\$\*[0-9]\*[0-9]\*192\*[0-9]\*[a-f0-9]{0,32}\*[a-f0-9]{288}\*[0-9]\*[0-9]\*[0-9]\*[^\s]{0,64}", re.IGNORECASE),
modes=[
HashInfo(
name="SecureZIP AES-192",
hashcat=23002,
john="securezip",
extended=False,
),
],
),
Prototype(
regex=re.compile(r"\$zip3\$\*[0-9]\*[0-9]\*128\*[0-9]\*[a-f0-9]{0,32}\*[a-f0-9]{288}\*[0-9]\*[0-9]\*[0-9]\*[^\s]{0,64}", re.IGNORECASE),
modes=[
HashInfo(
name="SecureZIP AES-128",
hashcat=23001,
john="securezip",
extended=False,
),
],
),
Prototype(
regex=re.compile(r"[a-f0-9]{24}", re.IGNORECASE),
modes=[
HashInfo(
name="PKZIP Master Key",
hashcat=20500,
john=None,
extended=False,
),
],
),
]
65 changes: 64 additions & 1 deletion tests/test_main.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -239,4 +239,67 @@ def test_office3():
]

x = runner.api_return_hashes_as_json(hashes)
assert "MS Office 2016 - SheetProtection" in x
assert "MS Office 2016 - SheetProtection" in x


def test_7zip():
hashes = [
"$7z$0$19$0$$16$c46ee87167606ba2cedbc7b61e970c63$3341692866$16$9$7f6b4ddc563d6481339775c52b653f00"
]

x = runner.api_return_hashes_as_json(hashes)
assert "7-zip" in x


def test_securezip():
hashes = [
"$zip3$*0*1*256*0*39bff47df6152a0214d7a967*65ff418ffb3b1198cccdef0327c03750f328d6dd5287e00e4c467f33b92a6ef40a74bb11b5afad61a6c3c9b279d8bd7961e96af7b470c36fc186fd3cfe059107021c9dea0cf206692f727eeca71f18f5b0b6ee1f702b648bba01aa21c7b7f3f0f7d547838aad46868155a04214f22feef7b31d7a15e1abe6dba5e569c62ee640783bb4a54054c2c69e93ece9f1a2af9d*0*0*0*file.txt"
]

x = runner.api_return_hashes_as_json(hashes)
assert "SecureZIP AES-256" in x


def test_pkzipMasterKey():
hashes = [
"f1eff5c0368d10311dcfc419"
]

x = runner.api_return_hashes_as_json(hashes)
assert "PKZIP Master Key" in x


def test_pdf1():
hashes = [
"$pdf$1*2*40*-1*0*16*51726437280452826511473255744374*32*9b09be05c226214fa1178342673d86f273602b95104f2384b6c9b709b2cbc058*32*0000000000000000000000000000000000000000000000000000000000000000"
]

x = runner.api_return_hashes_as_json(hashes)
assert "PDF 1.1 - 1.3 (Acrobat 2 - 4)" in x


def test_pdf2():
hashes = [
"$pdf$1*2*40*-1*0*16*01221086741440841668371056103222*32*27c3fecef6d46a78eb61b8b4dbc690f5f8a2912bbb9afc842c12d79481568b74*32*0000000000000000000000000000000000000000000000000000000000000000:6a8aedccb7"
]

x = runner.api_return_hashes_as_json(hashes)
assert "PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2" in x


def test_pdf3():
hashes = [
"$pdf$5*5*256*-1028*1*16*20583814402184226866485332754315*127*f95d927a94829db8e2fbfbc9726ebe0a391b22a084ccc2882eb107a74f7884812058381440218422686648533275431500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000*127*00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000*32*0000000000000000000000000000000000000000000000000000000000000000*32*0000000000000000000000000000000000000000000000000000000000000000"
]

x = runner.api_return_hashes_as_json(hashes)
assert "PDF 1.7 Level 3 (Acrobat 9)" in x


def test_pdf4():
hashes = [
"$pdf$5*6*256*-4*1*16*381692e488413f5502fa7314a78c25db*48*e5bf81a2a23c88f3dccb44bc7da68bb5606b653b733bcf9adaa5eb2c8ccf53abba66539044eb1957eda68469b1d0b9b5*48*b222df06deb308bf919d13447e688775fdcab972faed2c866dc023a126cb4cd4bbffab3683ecde243cf8d88967184680"
]

x = runner.api_return_hashes_as_json(hashes)
assert "PDF 1.7 Level 8 (Acrobat 10 - 11)" in x

0 comments on commit 2c3ad25

Please sign in to comment.