Is there a way to extract a password hash from AESCrypt archive? - Printable Version +- hashcat Forum (https://hashcat.net/forum) +-- Forum: Misc (https://hashcat.net/forum/forum-15.html) +--- Forum: General Talk (https://hashcat.net/forum/forum-33.html) +--- Thread: Is there a way to extract a password hash from AESCrypt archive? (/thread-8874.html) |
Is there a way to extract a password hash from AESCrypt archive? - Complexoctopus - 01-07-2020 I used this to make the archive https://www.aescrypt.com/ RE: Is there a way to extract a password hash from AESCrypt archive? - DanielG - 01-08-2020 on the official forum there is a topic about bruteforce a forgotten password on https://forums.packetizer.com/viewtopic.php?f=72&t=1333 there is a slow python version using the tool itself but a user claims to have a c version not requiring the tool. So if you can get your hands on that it would help analyse the problem. RE: Is there a way to extract a password hash from AESCrypt archive? - DanielG - 01-08-2020 okay, googling a bit more it seems the format is pretty open. The fileformat is described on https://www.aescrypt.com/aes_file_format.html and there is source on https://github.com/kenkendk/sharpaescrypt/ to encrypt/decrypt files. In the code on https://github.com/kenkendk/sharpaescrypt/blob/master/Source/SharpAESCrypt.cs#L523 it seems it uses the password to decrypt a part and hmac a part and compare, if that is equal the password is correct. So this should be doable. However I don't think hashcat can do this right now. RE: Is there a way to extract a password hash from AESCrypt archive? - Complexoctopus - 01-08-2020 Thanks! I sent him an email, let's see if he responds. RE: Is there a way to extract a password hash from AESCrypt archive? - philsmd - 01-09-2020 it seems that the algorithm is quite simple and there are a lot of alternative implementations. as a test I tried to find out if I'm able to recover/find the password of the example file from here: https://www.aescrypt.com/hello_world.txt, I've just developed a simple perl POC and I found the password within seconds (it's "hello", without quotes). Code: #!/usr/bin/env perl as already explained in the code, the main algo is explained also in pyAesCrypt (https://github.com/marcobellaccini/pyAesCrypt/blob/4b09ddc3737c539ee9fac179cab460abbb2b053e/pyAesCrypt/crypto.py#L59-L68) It is "just" 8192 iterations of "salted" sha256 of the utf16 encoded password and a final hmac of that hash as a key and the encrypted IV and encrypted Key as the HMAC "message". pretty straight forward algo and wouldn't be impossible to support this in hashcat, I guess You can always try to request it on https://github.com/hashcat/hashcat/issues/ just forgot: if you want to run this POC you could just use a command like this Code: perl aescrypt_hello_world.pl rockyou.txt of course if you want to use different data (IV, enc_iv, enc_key, HMAC etc), you need to change the script accordingly... you can easily see which bytes I took from the hello_world.txt file and how the file format works (https://www.aescrypt.com/aes_file_format.html) RE: Is there a way to extract a password hash from AESCrypt archive? - philsmd - 01-17-2020 update: we've now implemented this new algorithm: see https://github.com/hashcat/hashcat/issues/2267 and https://github.com/hashcat/hashcat/pull/2285 The hash format is also explained in the github pull request. The "hash" can be extracted with the aescrypt2hashcat.pl tool (currently supports version 2 of the aescrypt file format): https://raw.githubusercontent.com/hashcat/hashcat/master/tools/aescrypt2hashcat.pl (this of course needs to be downloaded and run with perl, perl must be installed: perl aescrypt2hashcat.pl encrypted_file.txt.aes) Could you please test @Complexoctopus with the latest beta version from https://hashcat.net/beta/ (only the beta version supports this new -m 22400 format at the time of this writing, of course) ? Thanks RE: Is there a way to extract a password hash from AESCrypt archive? - zub - 04-08-2020 Hi I am also intressted in this duplicati seems to use same algo. RE: Is there a way to extract a password hash from AESCrypt archive? - philsmd - 04-08-2020 just run it and see if it works for you (betas of hashcat are over https://hashcat.net/beta/). The extraction script can be found here: https://raw.githubusercontent.com/hashcat/hashcat/master/tools/aescrypt2hashcat.pl ( you need to run it with perl - install perl first - and give it the encrypted file as parameter) RE: Is there a way to extract a password hash from AESCrypt archive? - zub - 04-08-2020 (04-08-2020, 04:11 PM)philsmd Wrote: just run it and see if it works for you (betas of hashcat are over https://hashcat.net/beta/). got the hash now from perl ../aescrypt2hashcat.pl ../duplicati-20200401T124445Z.dlist.zip.aes > ../hash.txt : $aescrypt$1*ea8a4... but I run windows10 / cygwin the bin file do not start should I install ubuntu in wsl? RE: Is there a way to extract a password hash from AESCrypt archive? - philsmd - 04-08-2020 There is a file called hashcat.exe in the beta version, as well. You do not need to use ubuntu. Just use the exe files for windows. this should be a quite obvious thing to do and was also already mentioned a hundreds of time in the forum. |