Add Kerberos Hashes

[bee-san]

We're missing a lot of Kerberos hashes from this page:
https://hashcat.net/wiki/doku.php?id=example_hashes

Ctrl+F "Kerberos".

It's important we add them :)

See https://github.com/HashPals/Name-That-Hash/blob/main/name_that_hash/hashes.py for our DB of hashes.

[amadejpapez]

I recently learned about regex in one of my Python projects so I would be glad to help you with this! :) I started with one of the Kerberos hashes that are not in the Name-That-Hash and I came up with this:

Prototype(
        regex=re.compile(r"^\$krb5pa\$17\$[a-z0-9]+\$[a-z0-9]+\.[a-z0-9]+\$\$?[a-f0-9]+$", re.IGNORECASE),
        modes=[
            HashInfo(
                name="Kerberos 5, etype 17, Pre-Auth",
                hashcat=19800,
                john="krb5pa-sha1",
                extended=False,
            )
        ],
),

Here are two hashes I found and it detects both of them:
$krb5pa$17$hashcat$HASHCATDOMAIN.COM$a17776abe5383236c58582f515843e029ecbff43706d177651b7b6cdb2713b17597ddb35b1c9c470c281589fd1d51cca125414d19e40e333
$krb5pa$17$user1$EXAMPLE.COM$$c5461873dc13665771b98ba80be53939e906d90ae1ba79cf2e21f0395e50ee56379fbef4d0298cfccfd6cf8f907329120048fd05e8ae5df4

If everything is okay, I will continue to add others and will create a pull request with all of the changes when I am done :D

[bee-san]

I recently learned about regex in one of my Python projects so I would be glad to help you with this! :) I started with one of the Kerberos hashes that are not in the Name-That-Hash and I came up with this:

Prototype(
regex=re.compile(r"^$krb5pa$17$[a-z0-9]+$[a-z0-9]+.[a-z0-9]+$$?[a-f0-9]+$", re.IGNORECASE),
modes=[
HashInfo(
name="Kerberos 5, etype 17, Pre-Auth",
hashcat=19800,
john="krb5pa-sha1",
extended=False,
)
],
),
Here are two hashes I found and it detects both of them:
$krb5pa$17$hashcat$HASHCATDOMAIN.COM$a17776abe5383236c58582f515843e029ecbff43706d177651b7b6cdb2713b17597ddb35b1c9c470c281589fd1d51cca125414d19e40e333
$krb5pa$17$user1$EXAMPLE.COM$$c5461873dc13665771b98ba80be53939e906d90ae1ba79cf2e21f0395e50ee56379fbef4d0298cfccfd6cf8f907329120048fd05e8ae5df4

If everything is okay, I will continue to add others and will create a pull request with all of the changes when I am done :D

Hey!

Thanks SO much for doing that!!! Do you mind writing a description? The same one for each:

Prototype(
        regex=re.compile(r"^\$krb5pa\$17\$[a-z0-9]+\$[a-z0-9]+\.[a-z0-9]+\$\$?[a-f0-9]+$", re.IGNORECASE),
        modes=[
            HashInfo(
                name="Kerberos 5, etype 17, Pre-Auth",
                hashcat=19800,
                john="krb5pa-sha1",
                extended=False,
                description="Used for Windows Active Directory"
            )
        ],
),

This is just so everyone knows what it does, descriptions are super useful because someone that doesn't know what Kerberos is might see "Windows AD" and think "Huh! 🤔 This hash is from a Windows machine!"

And can you please write a test? You just need to copy & paste this:
https://github.com/HashPals/Name-That-Hash/blob/main/tests/test_main.py#L49-L56

And change:

• The function name
• The hash
  and finally:

+ assert "Kerberos" in x
- assert "scrypt" in x

Again, thank you so much for contributing! ❤️

[amadejpapez]

Yeah will add a description to each one and write a test. Glad to help and to improve my skills! :)

[bburky]

@amadejpapez That looks great. My only real concern is [a-z0-9]+ is probably a little too restrictive for the user and realm. It's likely that special characters are allowed there. Instead you can use [^$] to match everything but $, the separator character.

Using + is probably fine, but if you want to you can look and see what hashcat's limits are for each section:
https://github.com/hashcat/hashcat/blob/master/src/modules/module_19800.c#L98-L122

Interestingly hashcat requires the last section of hex to be between 104 and 112 characters, inclusive. (I think it's 104 + an optional checksum.)

This is an alternate regex that uses the above info:

^\$krb5pa\$17\$[^$]{1,512}\$[^$]{1,512}\$[a-f0-9]{104,112}$

This doesn't match your second example with $$ though. I'm not 100% it's the same hash type. Where did you get this hash from?

$krb5pa$17$user1$EXAMPLE.COM$$c5461873dc13665771b98ba80be53939e906d90ae1ba79cf2e21f0395e50ee56379fbef4d0298cfccfd6cf8f907329120048fd05e8ae5df4

[amadejpapez]

Will change that and do the same for the others. Thank you very much!

I saw the second one here: hashcat/hashcat#959 I think it should be same type but I could be wrong

[bburky]

Regarding the $$ hash: it appears that john support this hash format (and lists it as an example) but hashcat does not. Hashcat gives an error if you try to use it:

Hashfile '/tmp/hashes.txt' on line 2 ($krb5p...cfd6cf8f907329120048fd05e8ae5df4): Token length exception

I think John supports $krb5pa$etype$user$realm$salt$timestamp+checksum but hashcat only supports $krb5pa$17$user$realm$enc_timestamp+checksum. This $$ appears to tell john to use the default user + realm salt.

So.... no idea what to do here. Apparently John and hashcat support $krb5pa$17$ differently.

[bee-san]

@bburky Would we need 2 different regex's that point to the same hash type? It's an odd situation.

[bburky]

It's easy enough to write a regex that matches both, I'm just wondering if it would be confusing to our users. Yeah, double regexes is an option too, but we call them... what? "Kerberos 5 TGS-REP etype 17 (AES128-CTS-HMAC-SHA1-96) (John format)" . Would be pretty confusing too.

It's not too hard to just match both with the same regex, I'm just not sure if it's more or less confusing.

^\$krb5pa\$17\$[^$]{1,512}\$[^$]{1,512}\$(?:[^$]{0,52}\$)?[a-f0-9]{104,112}$

[amadejpapez]

I think having 2 different regexes in the database is the better and less confusing option.

The only difference I can see is that one format has a salt and the other one doesn't. So one could be named normal "Kerberos ..." for hashcat and second one could be named "Kerberos ... with salt" for john or something similar as @bburky already suggested.

This would not confuse users that much and it would quickly show if john or hashcat is supported if there is a match.

[bee-san]

In my opinion, if I'm following this thread correctly, we have 2 choices:

• Increase complexity of our code (by adding 2 regexes) but decrease complexity for the user (by separating Hashcat vs John)
• Decrease the complexity of our code, but increase complexity for the user

I think increasing the complexity of our code is better here. Fundamentally users come first, so sacrificing our sanity for a better tool is the best option here @amadejpapez

TL;DR - I agree with you.

[bee-san]

#63