{"id":548,"date":"2012-04-04T14:53:33","date_gmt":"2012-04-04T13:53:33","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=548"},"modified":"2012-08-09T12:36:55","modified_gmt":"2012-08-09T11:36:55","slug":"cracking-an-md5-of-an-ip-address","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2012\/04\/04\/cracking-an-md5-of-an-ip-address\/","title":{"rendered":"Cracking an MD5 of an IP address"},"content":{"rendered":"

So I noticed whilst web app testing that would receive a cookie with a value called bIPs:
\n709aed354747fda133a5da28dbed60e7
\n95eb48ad7eae5c0aa9766f0258ae8a35<\/strong><\/p>\n

Looks like it’s using a big IP load balancer<\/a>. I noticed it was MD5 and that was confirmed by finding the code that generates the hash<\/a>(cheers scriptmonkey).<\/p>\n

I decided to use Hashcat<\/a> to do the bruteforcing. First thing that came to mind was how to use a dictionary containing IP addresses. I did think about writing a script to generate a all_ips.dict file but it would be huge, 4,294,967,296 lines to be exact! No chance am I doing that!<\/p>\n

I then decided to try a bruteforce method but it wasn’t possible to generate a decent input mask that would work.<\/p>\n

A quick jump onto the hashcat irc channel at #hashcat on rizon network<\/a> and help from atom and Xanaderp came to the idea to generate 2 word lists, one for the first 2 octets and another for the second 2 octets.<\/p>\n

1
2
3
4
5
6
7
8
9
<\/div><\/td>
#!\/bin\/bash<\/span>
\nfor<\/span> a in<\/span> `<\/span>seq<\/span> 0<\/span> 255<\/span>`<\/span>
\ndo<\/span>
\n  for<\/span> b in<\/span> `<\/span>seq<\/span> 0<\/span> 255<\/span>`<\/span>
\n  do<\/span>
\n  echo<\/span> "$a<\/span>.$b<\/span>."<\/span> >><\/span> ips_left.txt
\n  echo<\/span> "$a<\/span>.$b<\/span>"<\/span> >><\/span> ips_right.txt
\n  done<\/span>
\ndone<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Update from Ben Campbell to do this all in one swoop \ud83d\ude42<\/p>\n

Each dictionary is 65536 lines long and so is only 500K or so in size \ud83d\ude42<\/p>\n

Now to perform the cracking:<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
<\/div><\/td>
phillips321@KubuntuDesktop:$ <\/span>.\/<\/span>oclHashcat-plus64.bin bIPs.txt -a<\/span> 1<\/span> ips_left.dict ips_right.dict
\noclHashcat-plus v0.07 by atom starting...
\nHashes: 2<\/span>
\nUnique digests: 2<\/span>
\nBitmaps: 8<\/span> bits, 256<\/span> entries, 0x000000ff mask, 1024<\/span> bytes
\nGPU-Loops: 128<\/span>
\nGPU-Accel: 40<\/span>
\nPassword lengths range: 1<\/span> - 15<\/span>
\nPlatform: AMD compatible platform found
\nWatchdog: Temperature limit set<\/span> to 90c
\nDevice #1: Cayman, 2048MB, 0Mhz, 22MCU<\/span>
\nDevice #1: Allocating 132MB host-memory<\/span>
\nDevice #1: Kernel .\/kernels\/4098\/m0000_a1.Cayman.64.kernel (250492 bytes)<\/span>
\nScanned dictionary ips_right.dict: 467968<\/span> bytes, 65536<\/span> words, 65536<\/span> keyspace, starting attack...
\nScanned dictionary ips_left.dict: 533504<\/span> bytes, 65536<\/span> words, 4294967296<\/span> keyspace, starting attack...
\n709aed354747fda133a5da28dbed60e7:172.16.40.150
\n95eb48ad7eae5c0aa9766f0258ae8a35:172.16.41.151
\nStatus.......: Cracked
\nInput.Base...: File (<\/span>ips_left.dict)<\/span>
\nInput.Mod....: File (<\/span>ips_right.dict)<\/span>
\nHash.Type....: MD5
\nTime.Running.: 4<\/span> secs
\nTime.Util....: 4001.3ms\/<\/span>0.0ms Real\/<\/span>CPU, 0.0<\/span>%<\/span> idle
\nSpeed........:   308.3M c\/<\/span>s Real,  1332.0M c\/<\/span>s GPU
\nRecovered....: 2<\/span>\/<\/span>2<\/span> Digests, 1<\/span>\/<\/span>1<\/span> Salts
\nProgress.....: 1233633280<\/span>\/<\/span>4294967296<\/span> (<\/span>28.72<\/span>%<\/span>)<\/span>
\nRejected.....: 0<\/span>\/<\/span>1233633280<\/span> (<\/span>0.00<\/span>%<\/span>)<\/span>
\nHW.Monitor.#<\/span>1<\/span>:  0<\/span>%<\/span> GPU, 44c Temp
\nStarted: Wed Apr  4<\/span> 14<\/span>:29<\/span>:31<\/span> 2012<\/span>
\nStopped: Wed Apr  4<\/span> 14<\/span>:29<\/span>:36<\/span> 2012<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Bingo, MD5 hashes of IP addresses cracked in 4 seconds!<\/p>\n

Update:<\/strong> Speaking with unix-ninja on the hashcat forum he mentioned that some devices do actually store the zero’s within their IP address, so 192.168.1.1 would actually be 192.168.001.001.<\/p>\n

Taking this into consideration I decided to quick throw together another script to combat this:<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
<\/div><\/td>
#!\/bin\/bash<\/span>
\nfor<\/span> a in<\/span> `<\/span>seq<\/span> 0<\/span> 2<\/span>`<\/span>
\ndo<\/span>
\n for<\/span> b in<\/span> `<\/span>seq<\/span> 0<\/span> 9<\/span>`<\/span>
\n  do<\/span>
\n  for<\/span> c in<\/span> `<\/span>seq<\/span> 0<\/span> 9<\/span>`<\/span>
\n    do<\/span>
\n   for<\/span> d in<\/span> `<\/span>seq<\/span> 0<\/span> 2<\/span>`<\/span>
\n   do<\/span>
\n    for<\/span> e in<\/span> `<\/span>seq<\/span> 0<\/span> 9<\/span>`<\/span>
\n     do<\/span>
\n     for<\/span> f in<\/span> `<\/span>seq<\/span> 0<\/span> 9<\/span>`<\/span>
\n       do<\/span>
\n      echo<\/span> "$a<\/span>$b<\/span>$c<\/span>.$d<\/span>$e<\/span>$f<\/span>."<\/span> >><\/span> ips_left.txt
\n        echo<\/span> "$a<\/span>$b<\/span>$c<\/span>.$d<\/span>$e<\/span>$f<\/span>"<\/span> >><\/span> ips_right.txt
\n     done<\/span>
\n    done<\/span>
\n   done<\/span>
\n  done<\/span>
\n  done<\/span>
\ndone<\/span>
\nfor<\/span> i in<\/span> `<\/span>seq<\/span> 256<\/span> 299<\/span>`<\/span>
\ndo<\/span>
\n grep<\/span> -v<\/span> $i<\/span> ips_left.txt ><\/span> ips_left.tmp &&<\/span> mv<\/span> ips_left.tmp ips_left.txt
\n grep<\/span> -v<\/span> $i<\/span> ips_right.txt ><\/span> ips_right.tmp &&<\/span> mv<\/span> ips_right.tmp ips_right.txt
\ndone<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Update<\/strong>
\nPrior to F5 load balancers using MD5 for the cookie they used to just encode it so you would result in something like:<\/p>\n

1
<\/div><\/td>
f5cookie=1005421066.20736.0000<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

This is relatively easy to decode:<\/p>\n

1
2
3
4
5
6
<\/div><\/td>
>>><\/span> import<\/span> struct<\/span>
\n>>><\/span> cookie =<\/span> "1005421066.20736.0000"<\/span>
\n>>><\/span> (<\/span>ip,<\/span>port,<\/span>end)<\/span>=<\/span>cookie.split<\/span>(<\/span>"."<\/span>)<\/span>
\n>>><\/span> (<\/span>a,<\/span>b,<\/span>c,<\/span>d)<\/span>=<\/span>[<\/span>ord<\/span>(<\/span>i)<\/span> for<\/span> i in<\/span> struct<\/span>.pack<\/span>(<\/span>"i"<\/span>,<\/span>int<\/span>(<\/span>ip)<\/span>)<\/span>]<\/span>
\n>>><\/span> print<\/span> "Decoded IP: %s %s %s %s"<\/span> % (<\/span>a,<\/span>b,<\/span>c,<\/span>d)<\/span>
\nDecoded IP: 10.130.237.59<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n","protected":false},"excerpt":{"rendered":"

So I noticed whilst web app testing that would receive a cookie with a value called bIPs: 709aed354747fda133a5da28dbed60e7 95eb48ad7eae5c0aa9766f0258ae8a35 Looks like it’s using a big IP load balancer. I noticed it was MD5 and that was confirmed by finding the code that generates the hash(cheers scriptmonkey). I decided to use Hashcat to do the bruteforcing. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[207,186,206,205,195],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/548"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=548"}],"version-history":[{"count":10,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/548\/revisions"}],"predecessor-version":[{"id":620,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/548\/revisions\/620"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}