binref / refinery

High Octane Triage Analysis
Other
618 stars 62 forks source link

Add unit for generating ntlm hash #23

Closed riskydissonance closed 1 year ago

riskydissonance commented 1 year ago

Adds a password_hashes.py module with an ntlm unit for converting the input to an ntlm hash.

Output: image

Compare with online generator: image

Not 100% sure what the best way to handle the input encoding is, python3 default string encoding is utf-8 so that's what we work with (as we have to decode the bytes to re-encode them as utf-16le), though there's the option to add an argument for different encodings if the input is known to be something else.

Please edit/move if it would be better elsewhere/done in a different way etc!

huettenhain commented 1 year ago

It can currently be replicated by doing

$ emit password | u16 -R | md4 -t
8846f7eaee8fb117ad06bdd830b7586c

But I honestly wouldn't have remembered that this is how NTLM hashes work, so having a separate unit makes sense to me. I have suggested two changes, and I'll happily merge with those in place.

huettenhain commented 1 year ago

Done & done, thank you for your contribution!