[NSE scripts] new script -- ipmi-dump-hashes.nse
Števaňák Roman <[email protected]> Sat, 13 Jul 2019 17:51:21 +0000
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <VI1PR02MB3648B8D185A45CBA686197749ECD0@VI1PR02MB3648.eurprd02.prod.outlook.com> |
--_004_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_
Content-Type: multipart/alternative;
boundary="_000_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_"
--_000_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_
Content-Type: text/plain; charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable
Hello,
I implemented a script from "Script ideas" page, "Solid candidates" section=
. In the attachment is a patch file, as was required.
My script dumps user password hashes for supplied usernames from BMC suppor=
ting IPMI 2.0, in a format that can be pasted directly into password cracki=
ng tool hashcat. The implementation was tested on VirtualBMC (https://docs.=
openstack.org/tripleo-docs/latest/install/environments/virtualbmc.html) in =
version 1.5.0 . It should allow for dumping hashes and then cracking them u=
sing offline attack, unlike with ipmi-brute, which sends request for each p=
assword. That way it should be more discreet and faster.
Please let me know what do you think of the script or what should be improv=
ed for it to be merged.
Kind regards,
Roman =A9teva=F2=E1k
--_000_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_
Content-Type: text/html; charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
2">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<span style=3D"color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica,=
sans-serif; font-size: 12pt;">Hello,</span><br>
</div>
<div>
<div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
I implemented a script from "Script ideas" page, "Solid cand=
idates" section. In the attachment is a patch file, as was required.</=
div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
My script dumps user password hashes for supplied usernames from BMC suppor=
ting IPMI 2.0, in a format that can be pasted directly into password cracki=
ng tool hashcat. The implementation was tested on VirtualBMC (<a href=3D"ht=
tps://docs.openstack.org/tripleo-docs/latest/install/environments/virtualbm=
c.html">https://docs.openstack.org/tripleo-docs/latest/install/environments=
/virtualbmc.html</a>)
in version 1.5.0 . It should allow for dumping hashes and then cracki=
ng them using offline attack, unlike with ipmi-brute, which sends request f=
or each password. That way it should be more discreet and faster.</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
Please let me know what do you think of the script or what should be improv=
ed for it to be merged.</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
Kind regards,</div>
<div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p=
t; color:rgb(0,0,0)">
Roman =A9teva=F2=E1k </div>
</div>
</div>
</body>
</html>
--_000_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_--
--_004_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_
Content-Type: text/x-patch; name="nmap.patch"
Content-Description: nmap.patch
Content-Disposition: attachment; filename="nmap.patch"; size=4670;
creation-date="Sat, 13 Jul 2019 17:49:52 GMT";
modification-date="Sat, 13 Jul 2019 17:49:52 GMT"
Content-Transfer-Encoding: base64
SW5kZXg6IHNjcmlwdHMvaXBtaS1kdW1wLWhhc2hlcy5uc2UKPT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gc2NyaXB0
cy9pcG1pLWR1bXAtaGFzaGVzLm5zZQkobm9uZXhpc3RlbnQpCisrKyBzY3JpcHRzL2lwbWktZHVt
cC1oYXNoZXMubnNlCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTMxIEBACitsb2NhbCBpcG1p
ID0gcmVxdWlyZSAiaXBtaSIKK2xvY2FsIG5tYXAgPSByZXF1aXJlICJubWFwIgorbG9jYWwgc2hv
cnRwb3J0ID0gcmVxdWlyZSAic2hvcnRwb3J0IgorbG9jYWwgc3RkbnNlID0gcmVxdWlyZSAic3Rk
bnNlIgorbG9jYWwgdW5wd2RiID0gcmVxdWlyZSAidW5wd2RiIgorCitkZXNjcmlwdGlvbiA9IFtb
CitEdW1wcyBwYXNzd29yZCBoYXNoZXMgZnJvbSBJUE1JIFJQQyBzZXJ2ZXIsIHNvIHRoZXkgY2Fu
IGJlIGNyYWNrZWQgYnkgZXh0ZXJuYWwgdG9vbCBzdWNoIGFzIGhhc2hjYXQuCisKK0lmIG5vbmUg
aXMgc3VwcGxpZWQsIG5zZWxpYi9kYXRhL3VzZXJuYW1lcy5sc3Qgd2lsbCBiZSB1c2VkLgorCitU
aGUgc2NyaXB0IHdvcmtzIGJ5IGV4cGxvaXRpbmcgdnVsbmVyYWJpbGl0eSBDVkUtMjAxMy00Nzg2
LCB3aGVyZSBpbiBzdGFuZGFyZCBjb21tdW5pY2F0aW9uLCBhdHRhY2tlciBjYW4gb2J0YWluLCBm
b3IgZXZlcnkga25vd24gdXNlciwgaGFzaCBjb250YWluaW5nIHBhc3N3b3JkLCB3aGljaCBjYW4g
YmUgbGF0ZXIgdXNlZCBmb3Igb2ZmbGluZSBjcmFja2luZy4gRnVydGhlcm1vcmUsIGlmIHRyaWVk
IHVzZXJuYW1lIGlzIG5vdCB2YWxpZCwgaXQgY2FuIGJlIHJlY29nbmlzZWQgZnJvbSB0aGUgY29t
bXVuaWNhdGlvbi4KK11dCisKKy0tLQorLS0gQHVzYWdlCistLSBubWFwIC1zVSAtLXNjcmlwdCBp
cG1pLWR1bXBoYXNoZXMgWy0tc2NyaXB0LWFyZ3M9InVzZXJkYj08ZGF0YWJhc2Ugb2YgdXNlcnM+
Il0gLXAgNjIzIDx0YXJnZXQ+CistLSBAYXJncyB1c2VyZGIgRmlsZSB3aXRoIHVzZXJuYW1lcyB0
byBiZSB1c2VkIGZvciBkdW1waW5nIGhhc2hlcyAob3B0aW9uYWwpCistLSBAb3V0cHV0CistLSBQ
T1JUICAgICBTVEFURSAgU0VSVklDRSBSRUFTT04KKy0tIDYyMy91ZHAgIG9wZW58ZmlsdGVyZWQg
IHVua25vd24KKy0tIHwgaXBtaS1kdW1waGFzaGVzOiAKKy0tIHwgICBmb3VuZDogCistLSB8XyAg
ICBhZG1pbjo1NDVhNTU0MltzaG9ydGVuZWRdMDU2MTY0NmQ2OTZlOjJmYmYzMmVbc2hvcnRlbmVk
XTU5NzRkMjdiZTA0MAorCithdXRob3IgPSAiUm9tYW4gU3RldmFuYWsiCitsaWNlbnNlID0gIlNh
bWUgYXMgTm1hcC0tU2VlIGh0dHBzOi8vbm1hcC5vcmcvYm9vay9tYW4tbGVnYWwuaHRtbCIKK2Nh
dGVnb3JpZXMgPSB7ImludHJ1c2l2ZSJ9CisKK3BvcnRydWxlID0gc2hvcnRwb3J0LnBvcnRfb3Jf
c2VydmljZSg2MjMsICJhc2Ytcm1jcCIsICJ1ZHAiLCB7Im9wZW4iLCAib3BlbnxmaWx0ZXJlZCJ9
KQorCit0ZXN0bmFtZSA9IGZ1bmN0aW9uKGhvc3QscG9ydCx1c2VybmFtZSkKKyAgLS0gc2V0dGlu
ZyB1cCBzb2NrZXQKKyAgbG9jYWwgc29ja2V0ID0gbm1hcC5uZXdfc29ja2V0KCd1ZHAnLCdpbmV0
JykKKyAgc29ja2V0OnNldF90aW1lb3V0KAorICAgICgoaG9zdC50aW1lcyBhbmQgaG9zdC50aW1l
cy50aW1lb3V0KSBvciA4KSAqIDEwMDApCisgIHNvY2tldDpjb25uZWN0KGhvc3QsIHBvcnQsICJ1
ZHAiKQorCisgIC0tIHNlbmRpbmcgUkNNUCsgb3BlbiBzZXNzaW9uIHJlcXVlc3QKKyAgbG9jYWwg
Y29uc29sZV9zZXNzaW9uX2lkID0gc3RkbnNlLmdlbmVyYXRlX3JhbmRvbV9zdHJpbmcoNCkKKyAg
bG9jYWwgY29uc29sZV9yYW5kb21faWQgPSBzdGRuc2UuZ2VuZXJhdGVfcmFuZG9tX3N0cmluZygx
NikKKyAgbG9jYWwgcmVxdWVzdCA9IGlwbWkuc2Vzc2lvbl9vcGVuX3JlcXVlc3QoY29uc29sZV9z
ZXNzaW9uX2lkKQorICBzb2NrZXQ6c2VuZChyZXF1ZXN0KQorCisgIC0tIHJlY2VpdmluZyBSQ01Q
KyBvcGVuIHNlc3Npb24gcmVzcG9uc2UKKyAgbG9jYWwgc3RhdHVzLCByZXBseQorICBzdGF0dXMs
IHJlcGx5ID0gc29ja2V0OnJlY2VpdmUoKQorCisgIGlmIG5vdCBzdGF0dXMgdGhlbgorICAgIHN0
ZG5zZS5kZWJ1ZygxLCAiTm8gcmVzcG9uc2UgdG8gUkNNUCsgb3BlbiBzZXNzaW9uIHJlcXVlc3Qg
ZnJvbSIKKyAgICAgIC4uIGhvc3QuaXAgLi4gIjoiIC4uIHBvcnQubnVtYmVyKQorICAgIHJldHVy
biBmYWxzZQorICBlbmQKKworICBsb2NhbCBzZXNzaW9uID0gaXBtaS5wYXJzZV9vcGVuX3Nlc3Np
b25fcmVwbHkocmVwbHkpCisgIGlmIHNlc3Npb25bInNlc3Npb25fcGF5bG9hZF90eXBlIl0gfj0g
aXBtaS5QQVlMT0FEU1siUk1DUFBMVVNPUEVOX1JFUCJdIHRoZW4KKyAgICBzdGRuc2UuZGVidWco
MSwgIlVua25vd24gUkNNUCsgb3BlbiBzZXNzaW9uIHJlc3BvbnNlIGluIgorICAgICAgLi4gaG9z
dC5pcC4uICI6IiAuLiBwb3J0Lm51bWJlcikKKyAgICByZXR1cm4gZmFsc2UKKyAgZWxzZWlmIHNl
c3Npb25bImVycm9yX2NvZGUiXSB+PSAwIHRoZW4KKyAgICBsb2NhbCBlcnJvcnN0ciA9IGlwbWku
Uk1DUF9FUlJPUlNbc2Vzc2lvbi5lcnJvcl9jb2RlXSBvciAiVW5rbm93biBlcnJvciIKKyAgICBz
dGRuc2UuZGVidWcoMSwgZXJyb3JzdHIgLi4gIiBpbiBSQ01QKyBvcGVuIHNlc3Npb24gcmVzcG9u
c2UgZnJvbSAiCisgICAgICAuLiBob3N0LmlwIC4uICI6IiAuLiBwb3J0Lm51bWJlcikKKyAgICBy
ZXR1cm4gZmFsc2UKKyAgZW5kCisKKyAgLS0gUkFLUDEgbWVzc2FnZSAtIHJlcXVlc3QKKyAgbG9j
YWwgYm1jX3Nlc3Npb25faWQgPSBzZXNzaW9uWyJibWNfc2Vzc2lvbl9pZCJdCisgIGxvY2FsIHJh
a3AxX3JlcXVlc3QgPSBpcG1pLnJha3BfMV9yZXF1ZXN0KAorICAgIGJtY19zZXNzaW9uX2lkLCBj
b25zb2xlX3JhbmRvbV9pZCwgdXNlcm5hbWUpCisgIHNvY2tldDpzZW5kKHJha3AxX3JlcXVlc3Qp
CisKKyAgLS0gUkFLUDIgbWVzc2FnZSAtIHJlc3BvbnNlCisgIHN0YXR1cywgcmVwbHkgPSBzb2Nr
ZXQ6cmVjZWl2ZSgpCisKKyAgaWYgbm90IHN0YXR1cyB0aGVuCisgICAgc3RkbnNlLmRlYnVnKDEs
ICJObyByZXNwb25zZSB0byBSQUtQMSBtZXNzYWdlIGZyb20iCisgICAgICAuLiBob3N0LmlwIC4u
ICI6IiAuLiBwb3J0Lm51bWJlcgorICAgICAgLi4gIiAtIFBvc3NpYmx5IG5vbmV4aXN0ZW50IHVz
ZXIiKQorICAgIHJldHVybiBmYWxzZQorICBlbmQKKworICBsb2NhbCByYWtwMl9tZXNzYWdlID0g
aXBtaS5wYXJzZV9yYWtwXzFfcmVwbHkocmVwbHkpCisKKyAgaWYgcmFrcDJfbWVzc2FnZVsic2Vz
c2lvbl9wYXlsb2FkX3R5cGUiXSB+PSBpcG1pLlBBWUxPQURTWyJSQUtQMiJdIHRoZW4KKyAgICBz
dGRuc2UuZGVidWcoMSwgIlVua25vd24gUkFLUDIgbWVzc2FnZSBmcm9tIgorICAgICAgLi4gaG9z
dC5pcCAuLiAiOiIgLi4gcG9ydC5udW1iZXIpCisgICAgcmV0dXJuIGZhbHNlCisgIGVsc2VpZiBy
YWtwMl9tZXNzYWdlWyJlcnJvcl9jb2RlIl0gfj0gMCB0aGVuCisgICAgbG9jYWwgZXJyb3JzdHIg
PSBpcG1pLlJNQ1BfRVJST1JTW3Jha3AyX21lc3NhZ2VbImVycm9yX2NvZGUiXV0KKyAgICAgIG9y
ICJVbmtub3duIGVycm9yIgorICAgIHN0ZG5zZS5kZWJ1ZygxLCBlcnJvcnN0ciAuLiAiIGluIFJB
S1AyIiAuLiBob3N0LmlwIC4uICI6IiAuLiBwb3J0KQorICAgIHJldHVybiBmYWxzZQorICBlbmQK
KyAtLSBUT0RPOiBzdXBwb3J0IEhNQUMtbWQ1IGFuZCBITUFDLXNoYTI1NiBhcyB3ZWxsCisgIGxv
Y2FsIGhtYWNfc2FsdCA9IGlwbWkucmFrcF9obWFjX3NoYTFfc2FsdCgKKyAgICAgIGNvbnNvbGVf
c2Vzc2lvbl9pZCwKKyAgICAgIHNlc3Npb25bImJtY19zZXNzaW9uX2lkIl0sCisgICAgICBjb25z
b2xlX3JhbmRvbV9pZCwKKyAgICAgIHJha3AyX21lc3NhZ2VbImJtY19yYW5kb21faWQiXSwKKyAg
ICAgIHJha3AyX21lc3NhZ2VbImJtY19ndWlkIl0sCisgICAgICAweDE0LAorICAgICAgdXNlcm5h
bWUKKyAgICApCisgIHJldHVybiB0cnVlLCByYWtwMl9tZXNzYWdlWyJobWFjX3NoYTEiXSwgaG1h
Y19zYWx0CitlbmQKKworYWN0aW9uID0gZnVuY3Rpb24oaG9zdCwgcG9ydCkKKyAgLS0gc2V0dGlu
ZyB1cCBvdXRwdXQKKyAgbG9jYWwgb3V0cHV0ID0gc3RkbnNlLm91dHB1dF90YWJsZSgpCisgIG91
dHB1dC5mb3VuZCA9IHt9CisgIAorICAtLSBsb2FkaW5nIHVzZXJuYW1lIGRhdGFiYXNlCisgIGxv
Y2FsIHRyeSA9IG5tYXAubmV3X3RyeSgpCisgIHVzZXJzID0gdHJ5KHVucHdkYi51c2VybmFtZXMo
KSkKKyAgCisgIC0tIGJydXRlZm9yY2luZworICBmb3IgdXNlcm5hbWUgaW4gdXNlcnMgZG8KKyAg
ICBzdGRuc2UuZGVidWcoMywgIlRyeWluZyIKKyAgICAgIC4uIHVzZXJuYW1lIC4uICI6IiAKKyAg
ICAgIC4uIGhvc3QuaXAgLi4gIjoiCisgICAgICAuLiBwb3J0Lm51bWJlcikKKyAgICBzdGF0dXMs
IGhtYWMsIHNhbHQgPSB0ZXN0bmFtZShob3N0LCBwb3J0LCB1c2VybmFtZSkKKyAgICAgIGlmIHN0
YXR1cyB0aGVuCisgICAgICAgIG91dHB1dC5mb3VuZFsjb3V0cHV0LmZvdW5kICsxXSA9IHVzZXJu
YW1lIC4uICI6IgorCSAgLi4gc3RkbnNlLnRvaGV4KHNhbHQpIC4uICI6IgorCSAgLi4gc3RkbnNl
LnRvaGV4KGhtYWMpCisgICAgICBlbmQKKyAgZW5kCisgIHJldHVybiBvdXRwdXQKK2VuZAo=
--_004_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/
--_004_VI1PR02MB3648B8D185A45CBA686197749ECD0VI1PR02MB3648eurp_--