Find algorithm from Digest and Plaintext

Question

I want to edit a connection string in a config file containing what seems to be a hashed password.

I know the followings:

-oldPwd in current configured file
-oldHash in current configured file
-newPwd

I want to generate hash(newPwd), but I need to define the used hash. How can I do it?

oldHash = i7DFG05HX+G/VCbVTxBY1w==

All my thinking is based on the fact that this is base64 of the hashed password... so a 128 bit binary, if I'm right.

Answer 1

If you can change the password to a known string, change it to "password" (or something simple), convert the base64 into the more common hex formatting with a command like this:

$ echo 'KGdV+tBIacpSMyCszg3GpA==' | base64 -d | xxd -g16
00000000: 286755fad04869ca523320acce0dc6a4  (gU..Hi.R3 .....

Then put the string (286755fad04869ca523320acce0dc6a4) into a file and run password-cracking tools against it using any 128-bit algorithm they support:

~/tools/JohnTheRipper/run $ echo '286755fad04869ca523320acce0dc6a4' > test.hex
~/tools/JohnTheRipper/run $ ./john --format=raw-md5 ./test.hex 
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Press 'q' or Ctrl-C to abort, almost any other key for status
[.....]

If you're lucky, it's something standard and it'll just pop.

Otherwise, you might have to do some sleuthing to figure out how it's salted or whatever.

Answer 2

All my thinking is based on the fact that this is base64 of the hashed password... so a 128 bit binary, if I'm right.

Yes, it's entirely plausible that you're dealing with a base64-encoded 128-bit hash. But you'd still have to guess which hashing function with 128 bits digest length was used - there is no shortcut for that.

E.g., the length would match MD5. In that case you could verify it with your known password like so:

$ echo "password" | openssl md5 -binary | base64 
KGdV+tBIacpSMyCszg3GpA==

The output string would have to match the hash in your config file.

Wikipedia has a list of cryptographic hash functions with their corresponding digest lengths. You could check all 128-bit entries via trial and error. But the smarter approach would of course be looking into the source code of the application you're dealing with, if that's possible.

Answer 3

There are tools out there that try and identify the hashing algorithm that is in use.

https://github.com/psypanda/hashID

Otherwise trying to crack the password using hashcat or the like, as suggested by Ron, may be a decent path to take.

If you have access to the applications source, assemblies or binaries, you can try and identify the components that are used for encryption and decryption. You can then either repurpose this code, gain enough insight into the algorithm in use to write something yourself, or find a tool.