GHash

[JunkPassword]

what is G-Hash-32?

The format of the password file appears to be a space / tab delimited  list of numerical user ID followed by an eight digit numerical hash. All hashes are in the mask format ?d?d?d?d?d?d?d?d
 
I was able to get access to a test users in order to compare known and cipher text passwords.
 
Known plain text = 30
Cipher text =43891846
 
Known plain text = 31
Cipher text =43691826
 
Known plain text = 32
Cipher text = 43391806
 
When I initially feed the cipher text to Blackploit’s Hash_ID.py (v1.1) it suggested GHash-32-5 and GHash-32-3 as possible hash formats.
 
Thanks for the link to Nitrxgen  http://www.nitrxgen.net/hashgen/. It looks like a very usueful tool. Based on my known inputs the hashes don’t match Ghash v3 or Ghash v5.
 
I found a file hashing tool (http://rehash.sourceforge.net/rehash.html) that seems to support GHash-32-3, GHash-32-5. I tried setting a file’s contents to “32” and calculating the ghash of the file with rehash. The result was different than Nitrxgen and didn’t match the cipher text.
 
At this point I’m not sure if the hash really is ghash or not. I am going to play with the numbers in Mathematica a bit to see what I can come up with.