CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 14:49:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix Oracle 10g password hashing function

Browse source 
* Non-alphanumeric characters were not processed correctly
  The correct hash for BOB:LONG_MOT_DE_PASSE_OUI is EC8147ABB3373D53,
  not 3DB3AA445FB68342.
* The hash is case-insensitive
This commit is contained in:
nnposter 2020-05-20 23:01:41 +00:00
parent 47ec607c6f
commit b9c8409022
2 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
CHANGELOG
View file

@ -52,6 +52,9 @@ o [Windows] Add support for the new loopback behavior in Npcap 0.9983. This
o [NSE][GH#2010] Oracle TNS parser was incorrectly unmarshalling DALC byte
arrays [nnposter]
o [NSE] The password hashing function for Oracle 10g was not working correctly
for non-alphanumeric characters [nnposter]
o [NSE] Virtual host probing list, vhosts-full.lst, was missing numerous
entries present in vhosts-default.lst [nnposter]

6
nselib/tns.lua
View file

@ -1435,7 +1435,7 @@ Crypt = {
-- @param password containing the Oracle user password
-- @return hash containing the Oracle hash
HashPassword10g = function( self, username, password )
local uspw = ( username .. password ):gsub("(%w)", "\0%1")
local uspw = (username .. password):upper():gsub(".", "\0%1")
local key = stdnse.fromhex("0123456789abcdef")
-- do padding
@ -1448,7 +1448,7 @@ Crypt = {
-- Test function, not currently in use
Decrypt10g = function(self, user, pass, srv_sesskey_enc )
local pwhash = self:HashPassword10g( user:upper(), pass:upper() ) .. "\0\0\0\0\0\0\0\0"
local pwhash = self:HashPassword10g( user, pass ) .. "\0\0\0\0\0\0\0\0"
local cli_sesskey_enc = stdnse.fromhex("7B244D7A1DB5ABE553FB9B7325110024911FCBE95EF99E7965A754BC41CF31C0")
local srv_sesskey = openssl.decrypt( "AES-128-CBC", pwhash, nil, srv_sesskey_enc )
local cli_sesskey = openssl.decrypt( "AES-128-CBC", pwhash, nil, cli_sesskey_enc )
@ -1479,7 +1479,7 @@ Crypt = {
-- @return auth_pass the encrypted Oracle password
Encrypt10g = function( self, user, pass, srv_sesskey_enc )
local pwhash = self:HashPassword10g( user:upper(), pass:upper() ) .. "\0\0\0\0\0\0\0\0"
local pwhash = self:HashPassword10g( user, pass ) .. "\0\0\0\0\0\0\0\0"
-- We're currently using a static client session key, this should
-- probably be changed to a random value in the future
local cli_sesskey = stdnse.fromhex("FAF5034314546426F329B1DAB1CDC5B8FF94349E0875623160350B0E13A0DA36")