diff --git a/package-lock.json b/package-lock.json index 3e851ebe..f731b882 100644 --- a/package-lock.json +++ b/package-lock.json @@ -66,6 +66,7 @@ "node-md6": "^0.1.0", "nodom": "^2.4.0", "notepack.io": "^3.0.1", + "ntlm": "^0.1.3", "nwmatcher": "^1.4.4", "otp": "0.1.3", "path": "^0.12.7", @@ -10537,6 +10538,14 @@ "url": "https://github.com/fb55/nth-check?sponsor=1" } }, + "node_modules/ntlm": { + "version": "0.1.3", + "resolved": "https://registry.npmjs.org/ntlm/-/ntlm-0.1.3.tgz", + "integrity": "sha512-pPlHxhAegZP4QAaOYd51vRd6VXTGfF7VLKJwuwN0iEB1aIi3SnqXYuS/bH/6wWBOq+Ehdil49mHm1Nseon085w==", + "engines": [ + "node" + ] + }, "node_modules/nwmatcher": { "version": "1.4.4", "resolved": "https://registry.npmjs.org/nwmatcher/-/nwmatcher-1.4.4.tgz", @@ -22304,6 +22313,11 @@ "boolbase": "^1.0.0" } }, + "ntlm": { + "version": "0.1.3", + "resolved": "https://registry.npmjs.org/ntlm/-/ntlm-0.1.3.tgz", + "integrity": "sha512-pPlHxhAegZP4QAaOYd51vRd6VXTGfF7VLKJwuwN0iEB1aIi3SnqXYuS/bH/6wWBOq+Ehdil49mHm1Nseon085w==" + }, "nwmatcher": { "version": "1.4.4", "resolved": "https://registry.npmjs.org/nwmatcher/-/nwmatcher-1.4.4.tgz", diff --git a/package.json b/package.json index f15eae76..51ec1adb 100644 --- a/package.json +++ b/package.json @@ -142,6 +142,7 @@ "node-md6": "^0.1.0", "nodom": "^2.4.0", "notepack.io": "^3.0.1", + "ntlm": "^0.1.3", "nwmatcher": "^1.4.4", "otp": "0.1.3", "path": "^0.12.7", @@ -170,7 +171,7 @@ "build": "npx grunt prod", "node": "npx grunt node", "repl": "node --experimental-modules --experimental-json-modules --experimental-specifier-resolution=node --no-warnings src/node/repl.mjs", - "test": "npx grunt configTests && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation tests/node/index.mjs && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation tests/operations/index.mjs", + "test": "npx grunt configTests && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation --openssl-legacy-provider tests/node/index.mjs && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation --openssl-legacy-provider tests/operations/index.mjs", "testnodeconsumer": "npx grunt testnodeconsumer", "testui": "npx grunt testui", "testuidev": "npx nightwatch --env=dev", diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json index 1db99db1..43d5dc4e 100644 --- a/src/core/config/Categories.json +++ b/src/core/config/Categories.json @@ -369,6 +369,8 @@ "Bcrypt compare", "Bcrypt parse", "Scrypt", + "NT Hash", + "LM Hash", "Fletcher-8 Checksum", "Fletcher-16 Checksum", "Fletcher-32 Checksum", @@ -378,8 +380,7 @@ "CRC-8 Checksum", "CRC-16 Checksum", "CRC-32 Checksum", - "TCP/IP Checksum", - "NTLM" + "TCP/IP Checksum" ] }, { diff --git a/src/core/operations/GenerateAllHashes.mjs b/src/core/operations/GenerateAllHashes.mjs index 8678ef65..2a4a2b1a 100644 --- a/src/core/operations/GenerateAllHashes.mjs +++ b/src/core/operations/GenerateAllHashes.mjs @@ -34,6 +34,8 @@ import BLAKE2b from "./BLAKE2b.mjs"; import BLAKE2s from "./BLAKE2s.mjs"; import Streebog from "./Streebog.mjs"; import GOSTHash from "./GOSTHash.mjs"; +import LMHash from "./LMHash.mjs"; +import NTHash from "./NTHash.mjs"; import OperationError from "../errors/OperationError.mjs"; /** @@ -107,6 +109,8 @@ class GenerateAllHashes extends Operation { {name: "Streebog-256", algo: (new Streebog), inputType: "arrayBuffer", params: ["256"]}, {name: "Streebog-512", algo: (new Streebog), inputType: "arrayBuffer", params: ["512"]}, {name: "GOST", algo: (new GOSTHash), inputType: "arrayBuffer", params: ["D-A"]}, + {name: "LM Hash", algo: (new LMHash), inputType: "str", params: []}, + {name: "NT Hash", algo: (new NTHash), inputType: "str", params: []}, {name: "SSDEEP", algo: (new SSDEEP()), inputType: "str"}, {name: "CTPH", algo: (new CTPH()), inputType: "str"} ]; diff --git a/src/core/operations/LMHash.mjs b/src/core/operations/LMHash.mjs new file mode 100644 index 00000000..2bedf0e8 --- /dev/null +++ b/src/core/operations/LMHash.mjs @@ -0,0 +1,41 @@ +/** + * @author n1474335 [n1474335@gmail.com] + * @copyright Crown Copyright 2022 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import {smbhash} from "ntlm"; + +/** + * LM Hash operation + */ +class LMHash extends Operation { + + /** + * LMHash constructor + */ + constructor() { + super(); + + this.name = "LM Hash"; + this.module = "Crypto"; + this.description = "An LM Hash, or LAN Manager Hash, is a deprecated way of storing passwords on old Microsoft operating systems. It is particularly weak and can be cracked in seconds on modern hardware using rainbow tables."; + this.infoURL = "https://wikipedia.org/wiki/LAN_Manager#Password_hashing_algorithm"; + this.inputType = "string"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + */ + run(input, args) { + return smbhash.lmhash(input); + } + +} + +export default LMHash; diff --git a/src/core/operations/NTLM.mjs b/src/core/operations/NTHash.mjs similarity index 57% rename from src/core/operations/NTLM.mjs rename to src/core/operations/NTHash.mjs index 432b9aee..51318135 100644 --- a/src/core/operations/NTLM.mjs +++ b/src/core/operations/NTHash.mjs @@ -10,20 +10,20 @@ import cptable from "codepage"; import {runHash} from "../lib/Hash.mjs"; /** - * NTLM operation + * NT Hash operation */ -class NTLM extends Operation { +class NTHash extends Operation { /** - * NTLM constructor + * NTHash constructor */ constructor() { super(); - this.name = "NTLM"; + this.name = "NT Hash"; this.module = "Crypto"; - this.description = "Performs NTLM hashing on the input. It works by running MD4 on UTF16LE-encoded input. NTLM hashes are considered weak because they can be brute-forced very easily with modern hardware."; - this.infoURL = "https://en.wikipedia.org/wiki/NT_LAN_Manager"; + this.description = "An NT Hash, sometimes referred to as an NTLM hash, is a method of storing passwords on Windows systems. It works by running MD4 on UTF-16LE encoded input. NTLM hashes are considered weak because they can be brute-forced very easily with modern hardware."; + this.infoURL = "https://wikipedia.org/wiki/NT_LAN_Manager"; this.inputType = "string"; this.outputType = "string"; this.args = []; @@ -35,7 +35,7 @@ class NTLM extends Operation { * @returns {string} */ run(input, args) { - const format = 1200; + const format = 1200; // UTF-16LE const encoded = cptable.utils.encode(format, input); const hashed = runHash("md4", encoded); @@ -43,4 +43,4 @@ class NTLM extends Operation { } } -export default NTLM; +export default NTHash; diff --git a/tests/operations/tests/GenerateAllHashes.mjs b/tests/operations/tests/GenerateAllHashes.mjs index 3e9b82b8..28707bde 100644 --- a/tests/operations/tests/GenerateAllHashes.mjs +++ b/tests/operations/tests/GenerateAllHashes.mjs @@ -50,6 +50,8 @@ BLAKE2s-256: f308fc02ce9172ad02a7d75800ecfc027109bc67987ea32aba9b8dcc7b10150e Streebog-256: 12a50838191b5504f1e5f2fd078714cf6b592b9d29af99d0b10d8d02881c3857 Streebog-512: 7200bf5dea560f0d7960d07fdc8874ad9f3b86ece2e45f5502ae2e176f2c928e0e581152281f5aee818318bed7cbe6aa69999589234723ceb33175598365b5c8 GOST: ee67303696d205ddd2b2363e8e01b4b7199a80957d94d7678eaad3fc834c5a27 +LM Hash: 01FC5A6BE7BC6929AAD3B435B51404EE +NT Hash: 0CB6948805F797BF2A82807973B89537 SSDEEP: 3:Hn:Hn CTPH: A:E:E @@ -79,6 +81,8 @@ MD5: 098f6bcd4621d373cade4e832627b4f6 RIPEMD-128: f1abb5083c9ff8a9dbbca9cd2b11fead BLAKE2b-128: 44a8995dd50b6657a037a7839304535b BLAKE2s-128: e9ddd9926b9dcb382e09be39ba403d2c +LM Hash: 01FC5A6BE7BC6929AAD3B435B51404EE +NT Hash: 0CB6948805F797BF2A82807973B89537 `, recipeConfig: [ { diff --git a/tests/operations/tests/NTLM.mjs b/tests/operations/tests/NTLM.mjs index 1dc39d5c..6dfa704c 100644 --- a/tests/operations/tests/NTLM.mjs +++ b/tests/operations/tests/NTLM.mjs @@ -9,14 +9,26 @@ import TestRegister from "../../lib/TestRegister.mjs"; TestRegister.addTests([ { - name: "NTLM Hashing", + name: "NT Hash", input: "QWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#$%^&*()_+.,?/", expectedOutput: "C5FA1C40E55734A8E528DBFE21766D23", recipeConfig: [ { - op: "NTLM", + op: "NT Hash", args: [], }, ], - } + }, + { + name: "LM Hash", + input: "QWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#$%^&*()_+.,?/", + expectedOutput: "6D9DF16655336CA75A3C13DD18BA8156", + recipeConfig: [ + { + op: "LM Hash", + args: [], + }, + ], + }, + ]);