john-users - Re: Oracle Application Express / Password hashes

Openwall wordlists collection for password cracking (20+ languages)
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 21 Feb 2013 17:53:19 +0530
From: Dhiru Kholia <dhiru.kholia@...il.com>
To: Guillaume Lopes <isec.gls@...il.com>
Cc: john-users@...ts.openwall.com, pen-test@...urityfocus.com
Subject: Re: Oracle Application Express / Password hashes

On Wed, Feb 20, 2013 at 6:31 PM, Dhiru Kholia <dhiru.kholia@...il.com> wrote:
> On Wed, Feb 20, 2013 at 5:04 PM, Guillaume Lopes <isec.gls@...il.com> wrote:
>> I have to crack password hashes from an Oracle application (APEX). The
>> version is APEX 4.0.
>>
>> Do you know a tool or another way to retrieve clear passwords from hashes ?
>
> Please bring this topic to "john-users" mailing list. JtR folks might
> be able to help you.

I was able to figure out the details of APEX 4.2.1 "default" hashing algorithm.

In short, stored hash = hashlib.md5(password + sgid + username).hexdigest()

I am posting a set of scripts to help in dumping APEX hashes from an
Oracle database and then subsequently cracking them using JtR-jumbo.

For step-by-step instructions, please see attached
README-apex-cracking.txt file.

✗ ../run/john -fo:dynamic_1 -t
Benchmarking: dynamic_1: md5($p.$s) (joomla) [128/128 SSE2 intrinsics
10x4x3]... DONE
Many salts:	14166K c/s real, 14166K c/s virtual
Only one salt:	10305K c/s real, 10305K c/s virtual

AFAIK commercial cracking tools (for APEX hashes) don't even come
close to JtR's speed ;)

-- 
Dhiru

ADMIN                                                                                               ,F96D32CBB2FBE17732C3BBAB91C14F3A                                                                                                                                                                                                                               ,               10

[ CONTENT OF TYPE application/octet-stream SKIPPED ]

[ CONTENT OF TYPE application/octet-stream SKIPPED ]

import hashlib

"""

1. Automated Way

C:\apex>sqlplus sys as sysdba

SQL*Plus: Release 11.2.0.2.0 Production on Fri Feb 22 17:20:51 2013

Copyright (c) 1982, 2010, Oracle.  All rights reserved.

Enter password:

Connected to:
Oracle Database 11g Express Edition Release 11.2.0.2.0 - Production

SQL> @dump-apex-hashes.sql

$ python apex2john.py apex-hashes.txt > apex-hashes-JtR

$ john pex-hashes-JtR # use JtR-jumbo from https://github.com/magnumripper/JohnTheRipper/
Loaded 1 password hash (dynamic_1: md5($p.$s) (joomla) [128/128 SSE2 intrinsics 10x4x3])
password         (?)
guesses: 1  time: 0:00:00:00 DONE (Thu Feb 21 17:33:43 2013)  c/s: 375  trying: 123456 - boomer

2. Manual Way

SQL> alter session set current_schema = APEX_040200;

Session altered.

SQL> select user_name,web_password2,security_group_id from wwv_flow_fnd_user;

USER_NAME
--------------------------------------------------------------------------------
WEB_PASSWORD2
--------------------------------------------------------------------------------
SECURITY_GROUP_ID
-----------------
ADMIN
F96D32CBB2FBE17732C3BBAB91C14F3A
10

"""

username = "ADMIN"
sgid = "10"
password = "password"

# APEX 4.2.1 algorithm
print hashlib.md5(password + sgid + username).hexdigest()

# should print "f96d32cbb2fbe17732c3bbab91c14f3a" which is the actual hash

[ CONTENT OF TYPE application/octet-stream SKIPPED ]