Update jtr formats #162
Update jtr formats #162
Conversation
| nt2 | ||
| o10glogon | ||
| o3logon | ||
| o5logon | ||
| odf |
There was a problem hiding this comment.
It looks like some of the opencl entries have been removed from this list. Checking framework it looks like that would only impact this line:
rapid7/metasploit-framework@6d2b7e0
But that jtr_format never existed here 🤔
There was a problem hiding this comment.
This list is really only used for search terms from what I can tell, since the value is rare I can see omitting it.
| krb5asrep | ||
| krb5pa-md5 | ||
| krb5pa-sha1 | ||
| krb5tgs |
There was a problem hiding this comment.
I'm not really sure what the intended semantics of 'non replayable' is when storing these types of creds; But for visibility the Kerberos tickets that are used to generate these hashes are not replayable, whilst the tickets themselves generally last for a day or so - unless they're golden tickets. i.e. hash generated from the original kerberos ticket isn't detailed enough generate the ticket again, or negotiate with Kerberos anymore.
There was a problem hiding this comment.
I believe 'non replayable' refers to if the hash would be usable to create a new authenticated session with the original auth provider, in the case of kerberos tickets I think the ticket itself may be 'non replayable' as it cannot be used to negotiate a new session after it expires, even if it is usable until the expiration with services that will validate it against the original provider.
There was a problem hiding this comment.
Only concern here is, removal of values a user may already have in the database would make then no longer filterable in the search function based on how this list is utilized in the command parsing.
This may be a moot point as common use case is short lived database content, but worth the mention.
|
I think this PR is still useful; but I'll put this back into draft until we've decided how we want to use the database to store kerberos tickets moving forwards 👍 |
Updating the JTR formats with
john --list=formatsand a quick split/sort/print with rubySTDIN.split(", ").map(&:downcase).map(&:strip).sort.join("\n")