hashcat Forum
Hash type? - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: General Help (https://hashcat.net/forum/forum-8.html)
+--- Thread: Hash type? (/thread-4499.html)



Hash type? - shadowolder - 07-03-2015

What type?
6879766D75076D00 (in clear password is 12345678)
6879766D75076D007F (in clear password is 123456789)
6879766D75076D007F1D (in clear password is 1234567899 )
60727C60790863017F (in clear password is 999999999 )
60727C60790863017F1D746072 (in clear password is 9999999999999 )
I get it from Oracle db.


RE: Hash type? - undeath - 07-03-2015

Looks like encrypted using an (wrongly implemented) OTP.

Code:
def group(e, n=2):
  res = []
  for x in range(len(e)//n):
    res.append(e[x*n:(x+1)*n])
  return res

def parseEnc(e):
  return list(map(lambda x: int(x, 16), group(e)))

def parseDec(e):
  return list(map(lambda x: ord(x), group(e, 1)))

def getKey(a,b):
  enc = parseEnc(a)
  dec = parseDec(b)
  assert len(enc) is len(dec)
  res = []
  for i in range(len(enc)):
    res.append(enc[i] ^ dec[i])
  
  return res

getKey("60727C60790863017F1D746072", "9999999999999")[:-2]
> [89, 75, 69, 89, 64, 49, 90, 56, 70, 36, 77]
getKey("6879766D75076D007F1D", "1234567899")
> [89, 75, 69, 89, 64, 49, 90, 56, 70, 36]



RE: Hash type? - shadowolder - 07-03-2015

That python code? Can you explain more detail, how i can decrypt others hashes?


RE: Hash type? - epixoip - 07-03-2015

It's just simple "XOR encryption." The key is 594b455940315a3846244d.


RE: Hash type? - shadowolder - 07-03-2015

I got it, thanks. Guys, now im looking code for mass decrypt my xor hashes from txt file (like 1-2k this hashes)
Maybe you have solution? Typing everytime in windows calc killing me


RE: Hash type? - epixoip - 07-03-2015

This thread is getting all script-kiddie way too fast. We gave you way more help than we probably should have. We told you what type of "encryption" is used, and even gave you the key. You should be able to figure it out from here.