Posts: 4
Threads: 1
Joined: Sep 2024
Hi everyone, new member here but I've been learning how to use Hashcat for around a week now. Reason being I am trying to recover a project password from a Schneider TM221 PLC I use at work. The guy who used to do my job will not divulge the password.
I've found what I believe to be the hashed password in a .dll file and it appears to be SHA-256. Now, my understanding of the way the hash is produced is that the plaintext password is hashed, hashed again and XOR is involved somewhere in this process too.
Does anyone have any experience of this type of password recovery or something similar?
Presumably the way this is done will render a wordlist attack useless and brute force will be looking for standard characters when the possibility of needing to find HEX is more likely.
I would appreciate any guidance at all with this and will of course do all my own leg work if I can take some help with the method.
Posts: 57
Threads: 0
Joined: Oct 2021
piehole1983, you need to know how password is hashed. Exact algorithm is necessary.
Then you can try to find and use existing hashcat module. If suitable module doesn't exist, you can develop and use your own module.
Posts: 4
Threads: 1
Joined: Sep 2024
(09-07-2024, 05:42 AM)nick8606 Wrote: piehole1983, you need to know how password is hashed. Exact algorithm is necessary.
Then you can try to find and use existing hashcat module. If suitable module doesn't exist, you can develop and use your own module.
Thankyou for the quick reply. I did see an article describing how the hash is created, I'll try to locate that again and go from there. I have found the hard coded key for part of the process as well as the final hash. I guess I'm about 30% there!
Posts: 4
Threads: 1
Joined: Sep 2024
I’ve done some more recon and have located the DH key exchange from both the client and the server as well as the hashed password in a given session. I used Wireshark to capture the data.
The DH keys are 4 bytes long. Am I correct in saying that the prime number used is 109 and the generator is 4? Once I can calculate the DH exchange the result will be the XOR key used to encrypt the SHA256 hash.
Any guidance or tips would be great! Absolute beginner here…
Posts: 1
Threads: 0
Joined: Oct 2026
It's been a long time but I am in a similar situation with schneider PLC. Can you update us please?
Posts: 4
Threads: 1
Joined: Sep 2024
It’s been a while! I worked at it for a little bit longer but gave up. I just didn’t have the time to dedicate to it. Coincidentally it did enter my mind recently and given the uptake of AI I might feed the info to an AI and see what it does.
I ended up getting a new PLC and rewriting the entire program from scratch to get the job done on site though.
Posts: 57
Threads: 0
Joined: Oct 2021
Once more from the very beginning. There is some software which works with project files of proprietary format. Files can be protected with passwords. Passwords are hashed, hashes are stored in project files and can be extracted. Is that right?
If so then task can be solved using steps below.
1. It's necessary to find algorithm of hashing. You can create your own project, set your own password, obtain hash and compare it with results of well-known algorithms. If algorithm has been recognized then skip steps 2, 3 and go to step 4.
2. If algorithm wasn't recognized then you need to analyze software and find algorithm inside it (so called reverse engineering is required). This step can be very difficult, but it is obligatory.
3. Try to find existing hashcat module. If appropriate module is absent, create and use your own module.
4. Launch and use hashcat.
