[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Nov 2010 15:39:21 -0500
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: PHP Script to Hash Plain-text input to LM/NTLM
It's a quick and dirty script that I threw together, 99% of the code
is lifted from the php.net hash() references:
http://www.php.net/manual/en/ref.hash.php#84587
http://www.php.net/manual/en/ref.hash.php#94990
I plan on making a more interactive script or a cli version soon, for
now here is the quick and dirty. Only creates LM and NTLM at this
time (in pwdump format) but more hashes will follow.
Script is looking for pt-input.txt for the plain-text passwords that will
be converted to LM and NTLM. Passwords should be one per line,
passes 15 or greater will result in a NULL LM hash. No length
checking for 127 (or greater) is done for the NTLM. I'm sure python or
Perl do all of this in 2-3 lines, nonetheless this was a fun exercise.
Enjoy, modify, spread good cheer :)
(formatted weird to keep the lines under 80-chars)
<?php
//Cobbled together by RichRumble, Xinn.org
//Code used is from:
//http://www.php.net/manual/en/ref.hash.php#84587
//http://www.php.net/manual/en/ref.hash.php#94990
header("Content-Type: text/plain");
function NTLMHash($Input) {
$Input=iconv('UTF-8','UTF-16LE',$Input);
$MD4Hash=hash('md4',$Input);
$NTLMHash=strtoupper($MD4Hash);
// Return the result
return($NTLMHash);
};
function LMhash($Input)
{
$Input = strtoupper(substr($Input,0,14));
$p1 = LMhash_DESencrypt(substr($Input, 0, 7));
$p2 = LMhash_DESencrypt(substr($Input, 7, 7));
return strtoupper($p1.$p2);
};
function LMhash_DESencrypt($Input)
{
$key = array();
$tmp = array();
$len = strlen($Input);
for ($i=0; $i<7; ++$i)
$tmp[] = $i < $len ? ord($Input[$i]) : 0;
$key[] = $tmp[0] & 254;
$key[] = ($tmp[0] << 7) | ($tmp[1] >> 1);
$key[] = ($tmp[1] << 6) | ($tmp[2] >> 2);
$key[] = ($tmp[2] << 5) | ($tmp[3] >> 3);
$key[] = ($tmp[3] << 4) | ($tmp[4] >> 4);
$key[] = ($tmp[4] << 3) | ($tmp[5] >> 5);
$key[] = ($tmp[5] << 2) | ($tmp[6] >> 6);
$key[] = $tmp[6] << 1;
$is = mcrypt_get_iv_size(MCRYPT_DES, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($is, MCRYPT_RAND);
$key0 = "";
foreach ($key as $k)
$key0 .= chr($k);
//Each keys is used to DES-encrypt the constant ASCII string "KGS!@#$%"
//(resulting in two 8-byte ciphertext values).
$LMHash = mcrypt_encrypt(MCRYPT_DES, $key0, "KGS!@#$%", MCRYPT_MODE_ECB, $iv);
return bin2hex($LMHash);
};
$array = file("pt-input.txt");
$a = 0;
foreach ($array as $line) {
if (strlen(trim($line)) > 14) {
$line = "";
} else {
$line = trim($line);
};
$NTLMout = NTLMHash($line);
$LMout = LMHash($line);
//Formatted PWDump output
print "user-" . $a++ . ":0:" . $LMout . ":" . $NTLMout . ":::" . "\n";
};
?>
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
