Determining the hash type I am working with for use in hashcat

1.4k Views Asked by At

I am trying to crack some hashed information because the passcode was lost to us. I have the hashed information in the database, and the code that was used to encrypt it. It goes through cryptastic which appears to use rijndael-256 and pbkdf2, as far as my ignorant self can tell:

public function encrypt($msg, $k, $base64 = false) {

    # open cipher module (do not change cipher/mode)
    if (!$td = mcrypt_module_open('rijndael-256', '', 'ctr', ''))
        return false;

    $msg = serialize($msg);                         # serialize
    $iv = mcrypt_create_iv(32, MCRYPT_RAND);        # create iv

    if (mcrypt_generic_init($td, $k, $iv) !== 0)  # initialize buffers
        return false;

    $msg = mcrypt_generic($td, $msg);               # encrypt
    $msg = $iv . $msg;                              # prepend iv
    $mac = $this->pbkdf2($msg, $k, 1000, 32, 'sha256');       # create mac
    $msg .= $mac;                                   # append mac

    mcrypt_generic_deinit($td);                     # clear buffers
    mcrypt_module_close($td);                       # close cipher module

    if ($base64)
        $msg = base64_encode($msg);# base64 encode?

    return $msg;                                    # return iv+ciphertext+mac
}

And in the end looks like this: wWTWLPvXT9YRz2Zj+Og0EwTTSEiZGdjAQ1TRhycJA9jusjQ2mTpptw3hSM1XJ9yPw+4XvsvFASe08AbLr3BT0LFnvGsYPrq87yI= (I know this to be a 3 digit number if that helps at all)

So I am trying to use hashcat to recover our information and I am not certain I am using the correct hash-type. I am checking this page here: https://hashcat.net/wiki/doku.php?id=example_hashes and searching for 'pbkdf2' and looking at all the hits.

The best match as far as I can tell is 9200/Cisco-IOS $8$ (PBKDF2-SHA256) except that that seems to have a header of $8$, and none of my information has any headers at all, and no $ characters. Everything else with PBKDF2 in it doesn't seem to be a match either so I find myself kind of lost before I've even gotten started.

I also noticed my hashed info always had == on the end, but only for the longer information being encrypted, in the list Juniper IVE seems to fit that format but the name doesn't match anything I can see in cryptastic.

I'm mostly ready to go aside from this as far as I can tell, I have my custom rules set up since I know how we create the initial passcodes and the hashes are in a file to be read, it's just this hash-type selection that is blocking me.

Any help appreciated!

0

There are 0 best solutions below