how can i crack hexmd5 hash ?

[monminamon]

if the the java script is
function hexMD5 (str) { return binl2hex(coreMD5( str2binl(str))) }

and the return from sniffing is 

document.sendin.password.value = hexMD5('\115' + document.login.password.value + '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311');

and the hash is cbc5d1a36621e0f824f5491ae9cf172c
and this hash 15b4c47a3e0e44b9e40db20ac1225023 
password is 22222222   
 i have tried every md5 type in hashcat to crack it but it failed !!

the MD5.JS

Captive Portal: stealing credentials

[philsmd]

you must be doing something wrong.
If I put the javascript code into my browser and run
hexMD5 ('\115' + "22222222" + '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311')
I get this result:
98db27e677daaecb6fc8718c0e9b0af8

This is exactly what I get when I use the md5sum:

Code:

echo -n 4d32323232323232320f965ab499a33a1562e3cb06590846c9 | xxd -p -r | md5sum

therefore your hashes above cbc5d1a366... and 15b4c47... are wrong. And why do you have 2 hashes at all ? It's only one md5 call, you should only have 1 hash.

The str2binl () and binl2hex () are just binary to hex conversations (and the reverse).

[monminamon]

you must be doing something wrong.
If I put the javascript code into my browser and run
hexMD5 ('\115' + "22222222" + '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311')
I get this result:
98db27e677daaecb6fc8718c0e9b0af8

This is exactly what I get when I use the md5sum:

Code:

echo -n 4d32323232323232320f965ab499a33a1562e3cb06590846c9 | xxd -p -r | md5sum

therefore your hashes above cbc5d1a366... and 15b4c47... are wrong. And why do you have 2 hashes at all ? It's only one md5 call, you should only have 1 hash.

The str2binl () and binl2hex () are just binary to hex conversations (and the reverse).

"do you have 2 hashes at all" because i have tried it two times ......
the first one is mine  the second  is from the Captive Portal: stealing credentials ..... so the javascript  isn't for the 22222222 password....

can you take a look on the is  for more info !!
https://www.reddit.com/r/HowToHack/comme...pt_hexmd5/

take a look on the tcp dump https://quickfileshare.org/2AX9/test.pcap

 excuse me for misinterpretation

[DanielG]

On https://miloserdov.org/?p=1088 it says the hash 15b4c47a3e0e44b9e40db20ac1225023 is for hexMD5('\301' + "22222222" + '\237\174\357\335\234\211\367\356\273\105\215\277\226\361\103\120') on the screenshot. But even that is not correct, this shows that you must have the exact hexMD5() extra data and corresponding md5 hash otherwise it will not work.

IF you are sure you have the correct hexMD5 with the corresponding intercepted password you can try to brute force it with:

Code:

hashcat -m 10 -a 3 --hex-salt --hex-charset -1 4d "cbc5d1a36621e0f824f5491ae9cf172c:0f965ab499a33a1562e3cb06590846c9" "?1?d?d?d?d?d?d?d?d"

--hex-charset -1 4d is the value '\115' in hex and not octal

cbc5d1a36621e0f824f5491ae9cf172c:0f965ab499a33a1562e3cb06590846c9 is your md5 with 0f965ab499a33a1562e3cb06590846c9 being '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311'

"?1?d?d?d?d?d?d?d?d" is trying 8 digit code for password.

But you have to be 100% sure that the hash cbc5d1a36621e0f824f5491ae9cf172c was set with the code hexMD5('\115' + document.login.password.value + '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311');

//edit:
I see you posted the pcap, this is most likely against forum rules because you are posting other peoples hashes. (also the login with those hashes were incorrect, so you are trying to brute-force an incorrect login)

[monminamon]

On https://miloserdov.org/?p=1088 it says the hash 15b4c47a3e0e44b9e40db20ac1225023 is for hexMD5('\301' + "22222222" + '\237\174\357\335\234\211\367\356\273\105\215\277\226\361\103\120') on the screenshot. But even that is not correct, this shows that you must have the exact hexMD5() extra data and corresponding md5 hash otherwise it will not work.

IF you are sure you have the correct hexMD5 with the corresponding intercepted password you can try to brute force it with:

Code:

hashcat -m 10 -a 3 --hex-salt --hex-charset -1 4d "cbc5d1a36621e0f824f5491ae9cf172c:0f965ab499a33a1562e3cb06590846c9" "?1?d?d?d?d?d?d?d?d"

--hex-charset -1 4d is the value '\115' in hex and not octal

cbc5d1a36621e0f824f5491ae9cf172c:0f965ab499a33a1562e3cb06590846c9 is your md5 with 0f965ab499a33a1562e3cb06590846c9 being '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311'

"?1?d?d?d?d?d?d?d?d" is trying 8 digit code for password.

But you have to be 100% sure that the hash cbc5d1a36621e0f824f5491ae9cf172c was set with the code hexMD5('\115' + document.login.password.value + '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311');

//edit:
I see you posted the pcap, this is most likely against forum rules because you are posting other peoples hashes. (also the login with those hashes were incorrect, so you are trying to brute-force an incorrect login)

"this shows that you must have the exact hexMD5() extra data and corresponding md5 hash otherwise it will not work."
So if the entered password is incorrect the hexmd5 will never be cracked !!!
This kinda disappointing ..
..
How did you convert this \115 to 4d ?!
........
"
this is most likely against forum rules because you are posting other peoples hashes. " what ?!! But these are my hashes ...
.......

"(so you are trying to brute-force an incorrect login)"
Yes just testing it to see if it's possible to crack the md5 ...

[monminamon]

On https://miloserdov.org/?p=1088 it says the hash 15b4c47a3e0e44b9e40db20ac1225023 is for hexMD5('\301' + "22222222" + '\237\174\357\335\234\211\367\356\273\105\215\277\226\361\103\120') on the screenshot. But even that is not correct, this shows that you must have the exact hexMD5() extra data and corresponding md5 hash otherwise it will not work.

IF you are sure you have the correct hexMD5 with the corresponding intercepted password you can try to brute force it with:

Code:

hashcat -m 10 -a 3 --hex-salt --hex-charset -1 4d "cbc5d1a36621e0f824f5491ae9cf172c:0f965ab499a33a1562e3cb06590846c9" "?1?d?d?d?d?d?d?d?d"

--hex-charset -1 4d is the value '\115' in hex and not octal

cbc5d1a36621e0f824f5491ae9cf172c:0f965ab499a33a1562e3cb06590846c9 is your md5 with 0f965ab499a33a1562e3cb06590846c9 being '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311'

"?1?d?d?d?d?d?d?d?d" is trying 8 digit code for password.

But you have to be 100% sure that the hash cbc5d1a36621e0f824f5491ae9cf172c was set with the code hexMD5('\115' + document.login.password.value + '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311');

//edit:
I see you posted the pcap, this is most likely against forum rules because you are posting other peoples hashes. (also the login with those hashes were incorrect, so you are trying to brute-force an incorrect login)

hi in which part of the tcp dump you find the wrong login response?!

[philsmd]

I think you are just heavily misinterpreting the tcp dump.

Just think about it a moment. The javascript code must be sent before the hexMD5 () password is sent, because the client needs to know what it should do with the password field and how it should sent it.
Therefore you just mixed up everything and the correct step is this:

for this hexMD5 ():

Code:

hexMD5('\137' + document.login.password.value + '\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032')

i.e. we have this in hexadecimal:

Code:

'\137' = 0x5f = _
'\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032' = 0x4d4e8bc54f3bcb860b224651a001db1a

I can crack this hash like this:

Code:

hashcat -m 10 -O -w 3 --hex-salt -j ^^_ cbc5d1a36621e0f824f5491ae9cf172c:4d4e8bc54f3bcb860b224651a001db1a dict.txt
cbc5d1a36621e0f824f5491ae9cf172c:4d4e8bc54f3bcb860b224651a001db1a:_575

Therefore the password is 575 (because the _ must be ignored because it was prepended by the algorithm)
Note: I think on windows you need to use ^^_ for the "normal" ^_ rule (because of escaping), you can also use a rule file with ^_ instead

---

back to the tcp dump misinterpretation problem. first the capture includes a hash without any previous javascript code sent ! that means that the capture was done in the middle of the communication. i.e. 8de6c4719419b4a9237acaeaa1a0e095 was sent without any previous javascript code. then we have one full correct communication with javascript hexMD5('\137' + document.login.password.value + '\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032') and the response cbc5d1a36621e0f824f5491ae9cf172c (see crack above), after that we only have 1 more javascript without any response (no more hash)

[DanielG]

Yeah what philsmd said.

The wrong login response was just the assumption you intercepted a random person logging in to the system. However the Arabic text after the login attempt says that the login failed. But this makes sense if it was you and you were trying random passwords.

[monminamon]

Yeah what philsmd said.

The wrong login response was just the assumption you intercepted a random person logging in to the system. However the Arabic text after the login attempt says that the login failed. But this makes sense if it was you and you were trying random passwords.

"However the Arabic text after the login attempt says that the login failed" 
where can i find this Arabic text?! 


"But this makes sense if it was you and you were trying random passwords."

yes this what i was trying to do

[monminamon]

I think you are just heavily misinterpreting the tcp dump.

Just think about it a moment. The javascript code must be sent before the hexMD5 () password is sent, because the client needs to know what it should do with the password field and how it should sent it.
Therefore you just mixed up everything and the correct step is this:

for this hexMD5 ():

Code:

hexMD5('\137' + document.login.password.value + '\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032')

i.e. we have this in hexadecimal:

Code:

'\137' = 0x5f = _
'\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032' = 0x4d4e8bc54f3bcb860b224651a001db1a

I can crack this hash like this:

Code:

hashcat -m 10 -O -w 3 --hex-salt -j ^^_ cbc5d1a36621e0f824f5491ae9cf172c:4d4e8bc54f3bcb860b224651a001db1a dict.txt
cbc5d1a36621e0f824f5491ae9cf172c:4d4e8bc54f3bcb860b224651a001db1a:_575

Therefore the password is 575 (because the _ must be ignored because it was prepended by the algorithm)
Note: I think on windows you need to use ^^_ for the "normal" ^_ rule (because of escaping), you can also use a rule file with ^_ instead

---

back to the tcp dump misinterpretation problem. first the capture includes a hash without any previous javascript code sent ! that means that the capture was done in the middle of the communication. i.e. 8de6c4719419b4a9237acaeaa1a0e095 was sent without any previous javascript code. then we have one full correct communication with javascript hexMD5('\137' + document.login.password.value + '\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032') and the response cbc5d1a36621e0f824f5491ae9cf172c (see crack above), after that we only have 1 more javascript without any response (no more hash)

hi thanks for the very good explanation
but back to the original form i found somewhere on the internet !

hexMD5('$(chap-id)' + passw + '$(chap-challenge)');

where can I find the formula that generates chap-id and chap challenge in TCP dump ?
or it's sent from the server ?
sorry for asking too many questions !! ;(
..................................................
and how did you do this part i again ?!
"
'\137' = 0x5f = _
'\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032' = 0x4d4e8bc54f3bcb860b224651a001db1a
"
i typed
'\137' in the browser and i got this "_"
but when i type '\115\116\213\305\117\073\313\206\013\042\106\121\240\001\333\032'
i get this nonsense "MN‹ÅO;ˆ"FQ
Û"
.......

"8de6c4719419b4a9237acaeaa1a0e095 was sent without any previous javascript code"
but what is that ?!

document.sendin.password.value = hexMD5('\115' + document.login.password.value + '\017\226\132\264\231\243\072\025\142\343\313\006\131\010\106\311');
i am really confused
..............
"I think on windows you need to use ^^_ for the "normal" ^_ rule (because of escaping), you can also use a rule file with ^_ instead "
what if i am brute forcing !!! what should the i type to add _ ??!
is there any problem with this _?d?d?d?

thank you very much