11-12-2015, 06:09 PM
(11-10-2015, 09:58 AM)atom Wrote: I doubt this will work. But Mem5 is kind of right because there's different base64 encodings floating around. Some of them are written in reverse order, some are not. Are those hashes from the MSSQL User table or from some 3rd party application storing user hashes inside a normal SQL Table? If from 3rd party, just lookup the code to see how they are generated.
It's the third party app storing the hashes. I don't think they're going to let me get a look at the code. We've contracted the vendor to build this app for our organization, and we got their permission to test it, so it's all legit, but the vendor isn't exactly happy about getting a security assessment. They'd rather we just take their word that everything is secure and don't look too closely. We haven't let them know we were able to pull hashes yet. Cracking the hashes would make a nice little cherry on top of the audit report, but even without them we've got plenty of findings.