Here are more details on the power consumption of my desktop computer when I crack passwords (cfr diary entry "Quickie: Password Cracking & Energy").

The vertical scale of this chart is expressed in Watts:

1. 0 Watt: my desktop computer is turned off
2. 76 Watt average: my desktop computer is turned on & idling
3. 151 Watt average: hashcat is running in dictionary attack mode cracking SHA256 hashes
4. 445 Watt average: hashcat is running in brute-force attack mode cracking SHA256 hashes

The most power is required (445 Watt) when hashcat is using the GPU ( NVIDIA GeForce RTX 3080) in brute-force attack mode. For comparison, 445 Watt average continuous is enough to heat my office in winter to a nice & comfy temperature, I don't need central heating in that room when hashcat is running for many hours.

You might wonder if 445 Watt is enough for that, given that electrical heaters typically come in 1000+ Watt models. But electrical heaters don't consume electrical power constantly to heat a room, they have a thermostat that shuts of current flow regularly when the desired room temperature is reached. They are more powerfull so that they can heat up a room faster. While my desktop computer requires 445 Watt continuously when cracking with the GPU.

 

Didier Stevens
Senior handler
blog.DidierStevens.com

PythonScript is a Notepad++ plugin that provides a Python interpreter to edit Notepad++ documents.

You install PythonScript in Notepad++ like this:

Use "New Script" to create a new Python script:

As an example, I will create a template substitution script, something that I use often. You provide a substitution template as input, and then each line of the open document is substituted according to the given template.

First we create the script substitute.py:

This is the template substitution script I developed:

def Substitute(contents, lineNumber, totalLines):
    contents = contents.rstrip('\n\r')
    if contents != '':
        editor.replaceLine(lineNumber, template.replace(token, contents))

token = notepad.prompt('Provide a token', 'Substitute token', '%%')
template = notepad.prompt('Provide a template', 'Substitute template', '')
if token != None and template != None:
    editor.forEachLine(Substitute)

You can paste it into Notepad++:

I will now demonstrate the script on a new document I created in Notepad++: the list of today's top 10 scanning IP addresses:

For each IP address, I want to generate a command that I will then execute.

The script can now be invoked to be executed on this open document like this:

The first line of Python script substitute.py to be executed, is line 6 (token = notepad.prompt...). It prompts the user for a token string (default %%), this is a string that, when used in the template string, will be replaced by each line in the open document

Line 7 prompts the user for a template string:

When the user has not cancelled answering the prompts (tested in line 8), line 9 (editor.forEachLine(Substitute)) is executed: it runs function Substitute on each line of the document:

Then I can copy/paste all these generated commands into a cmd.exe console:

This example is a bit contrived, as you could also use a for loop in the scripting shell to achieve the same result.

I also use this Python script often when I'm programming. Say that I want to hardcode this list of scanning IP addresses in a Python script. I can quickly create a Python list as follows:

And then I add the variable assignment statemnt and create a list:

 

Didier Stevens
Senior handler
blog.DidierStevens.com

I like to enrich my honeypot data from a variety of sources to help understand a bit more about the context of the attack. This includes the types of networks the attacks are coming from or whether malware submitted to a honeypot is new. I use a variety of sources to enrich my cowrie data using cowrieprocessor [1]:

• Internet Storm Center / DShield API [2]
• URLhaus [3]
• SPUR [4]
• VirusTotal [5]

I was curious how often the data changed and how "fresh" the data needs to be in order to be accurate. In a previous diary I went into details about VirusTotal data and vendor comparisons [6]. 

Data Collection

Data was pulled from the above sources using my cowrieprocessor script [1]. The script keeps a local copy of most enrichment data, which means I can always go through the JSON files at a later date to extract different information. The data I have goes back as far as May 2022. My honeypots schedule this data enrichment to happen once a day for attacks that happened the previous day. This means a minimum gap of time of 24 hours between enrichment data queries. This process was scheduled to run more frequently in 2022 and 2023 and may have a smaller gap between enrichment queries of 6-12 hours. 

VirusTotal Data

I extracted the following fields for comparison:

• ID (file hash)
• Malicious (number of vendors/engines that label the file as malicious)
• Suspicious  (number of vendors that label the file as suspicious)
• Undetected (number of vendors that did not have any detection)
• Harmless (number of vendors that label the file as harmless)
• Timeout (number of vendors that had a timeout)
• Confirmed-timeout (number of vendors that confirmed the timeout)
• Failure (number of vendors where a failure was reported)
• Type-unsupported (number of vendors that did not support the indicator type)
• Type_tag (type of file)
• Type_description (type description)

More details about the VirusTotal data fields can be found in their documentation [7]. The data was reviewed to look for hashes that showed a wide range of total "malicious" indicators as determined by different products. 

 

Date	Time	Hash	Malicious	Suspicious	Type Description
12/29/2023	120001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	1	0	ELF
12/29/2023	180002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	1	0	ELF
12/30/2023	003001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	1	0	ELF
3/3/2024	003001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	2	0	ELF
4/21/2024	003002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	2	0	ELF
7/18/2024	003001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	22	0	ELF
8/10/2024	003002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	26	0	ELF
8/13/2024	003002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	25	0	ELF
8/15/2024	003003	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	25	0	ELF

Figure 1: VirusTotal results over time for hash 062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a [8].

 

Date	Time	Hash	Malicious	Suspicious	Type Description
12/21/2023	180002	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	1	0	ELF
12/22/2023	003002	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	1	0	ELF
4/7/2024	003001	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	2	0	ELF
7/31/2024	003002	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	29	0	ELF

Figure 2: VirusTotal results over time for hash 47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c [9].

 

Date	Time	Hash	Malicious	Suspicious	Type Description
5/7/2023	060002	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	2	0	ELF
5/7/2023	120001	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	3	0	ELF
5/7/2023	180002	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	3	0	ELF
5/8/2023	003002	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	3	0	ELF
5/10/202	003001	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	24	0	ELF

Figure 3: VirusTotal results over time for hash 306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6 [10].

This demonstrates that VirusTotal data can take months to have a large increase in malicious hits. The hash from Figure 3 was first submitted on March 10, 2023, so even though it looks like a very quick change in my sample of data, this was approximatey two months from the initial submission. Even if the data looks stable, it may have a dramatic change.

 

URLhaus Data

URLHaus can be a good location of malicious URLs that may be used in phishing or other attacks, such as those seen in Cowrie honeypots. The data was reviewed to look for IP addresses that had a reported URL count change over time. In figure 4, the URL count increased by approximately 1 URL a day until it increased more dramatically between 11/8/2022 and 11/11/2022.

Figure 4: URLhaus reported URL changes over time for %%ip:179.43.175.5%%.

 

In figure 5, the IP address URL count almost doubled in a couple of days.

Figure 5: URLhaus reported URL changes over time for %%ip:193.42.33.81%%.

 

SPUR Data

The data compared was retrieved from SPUR, but this kind of WHOIS data is available from a variety of sources. First, I wanted to take a look at how many differences were seen in the registration data by IP address. I limited the information compared to the IP address, organization and location information.

 

Figure 6: Breakdown of IP addresses and how many unique sets of data were seen per IP address.

 

Over 3/4 of the IP addresses didn't have any change in the information reported. For the most part, the data doesn't change often. However, there were several IP addresses that had multiple changes. In figure 7, there were changes on average about once a month for the location.

Figure 7: IP Address %%ip:201.186.40.250%% showing changes in geographic regions over time.

 

In figure 8, the organization changed every couple of months between March and July of 2024. It may have changed more frequently, but was not recorded by my honeypot.

Figure 8: IP Address %%ip:101.32.114.105%% showing changes in organization name over time.

 

The raw WHOIS information for %%ip:101.32.114.105%% contains information that refers to both organizations listed from the SPUR data.

% Information related to '101.32.112.0 - 101.32.175.255'

% Abuse contact for '101.32.112.0 - 101.32.175.255' is 'qcloud_net_duty@tencent.com'

inetnum:        101.32.112.0 - 101.32.175.255
netname:        ACEVILLEPTELTD-SG
descr:          16 COLLYER QUAY
country:        SG
admin-c:        APA7-AP
tech-c:         APA7-AP
abuse-c:        AA1875-AP
status:         ALLOCATED NON-PORTABLE
mnt-by:         MAINT-ACEVILLEPTELTD-SG
mnt-irt:        IRT-ACEVILLEPTELTD-SG
last-modified:  2022-02-16T17:35:17Z
source:         APNIC

irt:            IRT-ACEVILLEPTELTD-SG
address:        16 COLLYER QUAY, # 18-29, INCOME AT RAFFLES, SINGAPORE
e-mail:         qcloud_net_duty@tencent.com
abuse-mailbox:  qcloud_net_duty@tencent.com
admin-c:        APA7-AP
tech-c:         APA7-AP
auth:           # Filtered
remarks:        qcloud_net_duty@tencent.com is invalid
mnt-by:         MAINT-ACEVILLEPTELTD-SG
last-modified:  2024-05-22T13:07:48Z
source:         APNIC

role:           ABUSE ACEVILLEPTELTDSG
address:        16 COLLYER QUAY, # 18-29, INCOME AT RAFFLES, SINGAPORE
country:        ZZ
phone:          +000000000
e-mail:         qcloud_net_duty@tencent.com
admin-c:        APA7-AP
tech-c:         APA7-AP
nic-hdl:        AA1875-AP
remarks:        Generated from irt object IRT-ACEVILLEPTELTD-SG
remarks:        qcloud_net_duty@tencent.com is invalid
abuse-mailbox:  qcloud_net_duty@tencent.com
mnt-by:         APNIC-ABUSE
last-modified:  2024-05-22T13:08:48Z
source:         APNIC

role:           ACEVILLE PTELTD administrator
address:        16 COLLYER QUAY, #18-29, INCOME AT RAFFLES, SINGAPORE
country:        SG
phone:          +8613923479936
fax-no:         +8613923479936
e-mail:         qcloud_net_duty@tencent.com
admin-c:        APA7-AP
tech-c:         APA7-AP
nic-hdl:        APA7-AP
mnt-by:         MAINT-ACEVILLEPTELTD-SG
last-modified:  2023-03-17T12:36:41Z
source:         APNIC

 

Regardless of where you get your enrichment data, it will change over time. Get updated information when you can and use multiple sources of enrichment data for comparison.

 

[1] https://github.com/jslagrew/cowrieprocessor
[2] https://isc.sans.edu/api/
[3] https://urlhaus.abuse.ch/
[4] https://spur.us/
[5] https://www.virustotal.com/
[6] https://isc.sans.edu/diary/VirusTotal+Result+Comparisons+for+Honeypot+Malware/29040
[7] https://github.com/demisto/content/blob/master/Packs/VirusTotal/Integrations/VirusTotalV3/README.md
[8] https://www.virustotal.com/gui/file/062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a
[9] https://www.virustotal.com/gui/file/47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c
[10] https://www.virustotal.com/gui/file/306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6
[11] https://bgpview.io/prefix/101.32.114.0/23#whois

--
Jesse La Grew
Handler

[This is a Guest Diary by Joshua Tyrrell, an ISC intern as part of the SANS.edu BACS program]

Managing the Attack Surface

You’ve begun the journey of reviewing your IT infrastructure and attempting to figure out how to protect yourself from those who might not have the greatest intentions. That’s great! Stop yourself though, before you get too far into the weeds of the different technologies available to you to defend yourself. Before you get to that point, there are some details that need to be fleshed out. Let’s have a look:

• What industry are you in? Depending on the service provided, you may already have a baseline that you need to be at, provided to you by those who came before you and have danced with those who mean you harm.
• Where and who do you do business with? If you’re a utility provider in Topeka, Kansas, does it make sense to have your online presence available to the general public outside of the Continental United States? Think about the potential risk versus limiting access to those who need to manage it.
• What does your organization actually need to be successful? What data do you actually need to survive, what devices are necessary, what software will get you to where you need to be?

These are all pertinent questions to either scaling up or scaling down your attack surface and working towards having chaos-free Friday nights. 

Fortify the Exterior Walls

Defense-in-Depth is the name of the game in the 21st Century, but that doesn’t mean we shouldn’t be doing what we can to make sure the perimeter walls aren’t as imposing as possible. You use firewalls, yes, but are you using them to their maximum potential? Modern firewalls allow for geo-blocking, which is the blocking of traffic based on IP addresses correlated to countries. These databases are updated somewhat regularly, so there is maintenance to be done on your firewalls to make sure they’re up to date. If you’d like even stronger evidence for using geo-blocking, search for “Top 10 Countries where cyber attacks originate”. Lists have been generated by teams across the world to show where many of the world’s cyber criminals are calling home. Now though, what if you do have a business partner that resides in one of those countries that you may not want traffic widely from? Easy enough, create an exception for their ASN in the geo-fence. 

Another tool at your disposal is reputation filtering. This process allows your firewall to reference the IP of either source or destination and forward or drop the packet as per the policy. This can be highly effective at reducing the amount of potentially malicious traffic that is not initially blocked by your geo-fence. Take heed though: Cloud Service Providers may be unintentionally flagged and dropped due to the nature of their business model. There is a way to help you navigate this mystery though, and that is to simply look at who the largest CSP’s are, and weigh that against historical traffic to your assets. You may want to allow AWS, Azure, GCP, and even DigitalOcean, but how about that small-time server farm in Seychelles? Or the Netherlands? Those you can probably block outright, after considering those initial questions we talked about earlier. 

We spoke about traffic coming to the outer walls, but what about traffic trying to get out of the gate? You should consider blocking websites internally. i.e. social media sites. You can go one step further and segment your network to allow certain employees to access those sites, should it be within their role’s purview. If employees want to peruse social media while working, let’s say they’re on downtime, then force them to connect their devices to a well-segmented guest network. It is probably not worth allowing them to access these things from a network that also houses production environments though. 

Email is one of the most widely abused mechanisms for delivering malware and social engineering. What can we do about it though? Well let’s set up an email gateway, so we can filter out the wheat from the chaff. Modern email gateways allow integration of services like VirusTotal, which would scan the email attachments and flag them for being potentially malicious. You could also integrate a sandbox, which would then scan and ‘detonate’ email attachments to find the malicious threats hidden in the mail. Obviously, before implementing these services you need to test them. That goes for all your possible interventions though; don’t just throw things into your infrastructure and hope for the best. 

Another way to protect from bad emails is reputation filtering, much the same way we discussed earlier. There is a problem however- scammers, spammers and all the other generally not-so great people like to use free email services like Gmail, much like the rest of us. So, what could we do? We can’t just block inbound Gmail, that could be disastrous for communications. What we can do is server-side filtering to allow the free email services to go to some internal email addresses but not to another. Your customer service team might need to talk to people who are using Gmail, but how about your engineering team? Or your HR team? 

You can safely assume that these protections can be costly, in terms of both finance and time. If you’re a smaller organization, these might not be feasible to do, at least in-house. You may have to source the assistance of a third party, or perhaps form a consortium with other like-entities and purchase the solutions from a vendor. When considering time, think about your mean time to recovery. If you’re organization is breached, how long do you have until there’s no coming back?

Harden your Outposts

You need to be better at managing your devices. You might find the tone accusatory, which is fine, it’s supposed to be. By reading that statement though, you probably just started doing an inventory of all the things you’ve done to protect your endpoints, to the best of your knowledge and ability. Let’s look at some of the top things you can do to make sure you’re best protected.

First, you need to inventory what you have. You cannot protect what you don’t know exists, so go ahead and run that internal nmap discovery scan to find that web server you stood up 10 years ago but then never touched again. 

Now that you know what you have, let’s take a look at patches. Patching needs to be done, or if not, then you need a good excuse and mechanisms to protect the enterprise from issues that may arise from leaving a weakness in the network defenses. Depending on where that weakness is, you’ll need to increase the surveillance on the assets that connect to that unpatched or out-of-date asset. Patch management also needs to exist, don’t just run “Scan for Updates” on your Windows machine then let it update in the middle of the workday. Have yourself a testing environment, and stage those updates. If you need any other supporting evidence for this notion, then I’ll direct your attention to the recent global CrowdStrike outage. 

BYOD, or “Bring Your Own Device”, is an idea that has taken off due to cost, but it does have its issues. The first issue is vulnerability management for that device. You have potentially hundreds or even thousands of different devices that you have no control of whether they are up to date with the latest security patches. If you cannot avoid BYOD, say because of cost, then you’ll need to really be up to date on what devices your employees are hooking to the network. Make a note of the devices they plan on using for work, and if they purchase a new one, have them reach out to your IT staff and let them know about it. If you cannot control what devices are accessing your data, then you’ll need to compensate by working even harder to manage your alerting mechanisms.

Data commingling is another issue. How to control what happens to the business data that is on that device? Applications as well, having no idea what these people are downloading on to their devices and the vulnerabilities they are introducing. More on Application Control: find the best possible software for what you need it to do and stick to that. It does you no favors to use several different IDEs for software development, or package management. This also assists in general IT operations, not just security. 

Managing the attack surface is no easy task, and entire books could be and have been written on what to should do. I hope though, that what I’ve highlighted here today helps you down your path. 

[1] https://www.sans.edu/cyber-security-programs/bachelors-degree/

-----------
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

On August 10th, the popular learning platform "Moodle" released an update fixing %%cve:2024-43425%%. RedTeam Pentesting found the vulnerability and published a detailed blog post late last week. The blog post demonstrates in detail how a user with the "trainer" role could execute arbitrary code on the server. A trainer would have to publish a "calculated question". These questions are generated dynamically by evaluating a formula. Sadly, the formula was evaluated using PHP's "eval" command. As pointed out by RedTeam Pentesting, "eval" is a very dangerous command to use and should be avoided if at all possible. This applies not only to PHP but to most languages (also see my video about command injection vulnerabilities). As I usually say: "eval is only one letter away from evil".

The exploit does require the attacker to be able to publish questions. However, Moodle is used by larger organizations like Universities. An attacker may be able to obtain credentials as a "trainer" via brute forcing or credential stuffing.

I got pointed to "Moodle" after seeing this URL in our "First Seen" list of newly accessed URLs:

/lib/ajax/service.php?info=tool_mobile_get_public_config&lang=en

This "public config" may return additional details in some cases, but from my tests with a demo instance of Moodle, it only returns:

 {"error":"Coding error detected, it must be fixed by a programmer: Invalid json in request: Syntax error","errorcode":"codingerror","stacktrace":null,"debuginfo":null,"reproductionlink":null}

At least this URL could be used to find Moodle instances and probe them later with more specific exploits. I will have to add this case to our honeypot responses to get more details. These scans are not new, but we had only individual scans (one or two per day) so they never passed our threshold as "significant". Only yesterday did they pass the "line".

But in the meantime:

1. Keep Moodle up to date (they do have a decent chart outlining support timeframes for different versions)
2. Audit the "trainer" accounts, not just because of the vulnerability, but in general, they can cause damage to the system.
3. Let me know if you have additional insight into Moodle. Is there something else that this URL could trigger?

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

Just like "Protected OOXML Spreadsheets", Word documents can also be protected:

You have to look into the word/settings.xml file, and search for element w:documentProtection:

The hash algorithm is the same as for OOXML spreadsheets. However, you will not be able to use hashcat to crack protected Word document hashes, because the password is encoded differently before it is repeatedly hashed.

A legacy algorithm is used to preprocess the password, and I found a Python implementation here.

# https://stackoverflow.com/questions/65877620/open-xml-document-protection-implementation-documentprotection-class
dHighOrderWordLists = [
    [0xE1, 0xF0],
    [0x1D, 0x0F],
    [0xCC, 0x9C],
    [0x84, 0xC0],
    [0x11, 0x0C],
    [0x0E, 0x10],
    [0xF1, 0xCE],
    [0x31, 0x3E],
    [0x18, 0x72],
    [0xE1, 0x39],
    [0xD4, 0x0F],
    [0x84, 0xF9],
    [0x28, 0x0C],
    [0xA9, 0x6A],
    [0x4E, 0xC3]
]

dEncryptionMatrix = [
    [[0xAE, 0xFC], [0x4D, 0xD9], [0x9B, 0xB2], [0x27, 0x45], [0x4E, 0x8A], [0x9D, 0x14], [0x2A, 0x09]],
    [[0x7B, 0x61], [0xF6, 0xC2], [0xFD, 0xA5], [0xEB, 0x6B], [0xC6, 0xF7], [0x9D, 0xCF], [0x2B, 0xBF]],
    [[0x45, 0x63], [0x8A, 0xC6], [0x05, 0xAD], [0x0B, 0x5A], [0x16, 0xB4], [0x2D, 0x68], [0x5A, 0xD0]],
    [[0x03, 0x75], [0x06, 0xEA], [0x0D, 0xD4], [0x1B, 0xA8], [0x37, 0x50], [0x6E, 0xA0], [0xDD, 0x40]],
    [[0xD8, 0x49], [0xA0, 0xB3], [0x51, 0x47], [0xA2, 0x8E], [0x55, 0x3D], [0xAA, 0x7A], [0x44, 0xD5]],
    [[0x6F, 0x45], [0xDE, 0x8A], [0xAD, 0x35], [0x4A, 0x4B], [0x94, 0x96], [0x39, 0x0D], [0x72, 0x1A]],
    [[0xEB, 0x23], [0xC6, 0x67], [0x9C, 0xEF], [0x29, 0xFF], [0x53, 0xFE], [0xA7, 0xFC], [0x5F, 0xD9]],
    [[0x47, 0xD3], [0x8F, 0xA6], [0x0F, 0x6D], [0x1E, 0xDA], [0x3D, 0xB4], [0x7B, 0x68], [0xF6, 0xD0]],
    [[0xB8, 0x61], [0x60, 0xE3], [0xC1, 0xC6], [0x93, 0xAD], [0x37, 0x7B], [0x6E, 0xF6], [0xDD, 0xEC]],
    [[0x45, 0xA0], [0x8B, 0x40], [0x06, 0xA1], [0x0D, 0x42], [0x1A, 0x84], [0x35, 0x08], [0x6A, 0x10]],
    [[0xAA, 0x51], [0x44, 0x83], [0x89, 0x06], [0x02, 0x2D], [0x04, 0x5A], [0x08, 0xB4], [0x11, 0x68]],
    [[0x76, 0xB4], [0xED, 0x68], [0xCA, 0xF1], [0x85, 0xC3], [0x1B, 0xA7], [0x37, 0x4E], [0x6E, 0x9C]],
    [[0x37, 0x30], [0x6E, 0x60], [0xDC, 0xC0], [0xA9, 0xA1], [0x43, 0x63], [0x86, 0xC6], [0x1D, 0xAD]],
    [[0x33, 0x31], [0x66, 0x62], [0xCC, 0xC4], [0x89, 0xA9], [0x03, 0x73], [0x06, 0xE6], [0x0D, 0xCC]],
    [[0x10, 0x21], [0x20, 0x42], [0x40, 0x84], [0x81, 0x08], [0x12, 0x31], [0x24, 0x62], [0x48, 0xC4]]
]


def WordEncodePassword(password):
  password_bytes = password.encode('utf-8')
  password_bytes = password_bytes[:15]

  password_length = len(password_bytes)

  if password_length > 0:
    high_order_word_list = dHighOrderWordLists[password_length - 1].copy()
  else:
    high_order_word_list = [0x00, 0x00]

  for i in range(password_length):
    password_byte = password_bytes[i]
    matrix_index = i + len(dEncryptionMatrix) - password_length

    for j in range(len(dEncryptionMatrix[0])):
      # Only perform XOR operation using the encryption matrix if the j-th bit is set
      mask = 1 << j
      if (password_byte & mask) == 0:
        continue

      for k in range(len(dEncryptionMatrix[0][0])):
        high_order_word_list[k] = high_order_word_list[k] ^ dEncryptionMatrix[matrix_index][j][k]

  low_order_word = 0x0000

  for i in range(password_length - 1, -1, -1):
    password_byte = password_bytes[i]
    low_order_word = (
      (((low_order_word >> 14) & 0x0001) | ((low_order_word << 1) & 0x7fff))
      ^ password_byte
    )

  low_order_word = (
    (((low_order_word >> 14) & 0x0001) | ((low_order_word << 1) & 0x7fff))
    ^ password_length
    ^ 0xce4b
  )

  low_order_word_list = [(low_order_word & 0xff00) >> 8, low_order_word & 0x00ff]

  key = high_order_word_list + low_order_word_list
  key.reverse()

  # `key_str` is a hex string with uppercase hexadecimal letters, e.g. '7EEDCE64'
  key_str = ''.join(f'{c:X}' for c in key)

  return key_str

This password preprocessing code can then be used with the same hashing function as for Excel, like this:

def CalculateHash(password, salt):
    passwordBytes = password.encode('utf16')[2:]
    buffer = salt + passwordBytes
    hash = hashlib.sha512(buffer).digest()
    for iter in range(100000):
        buffer = hash + struct.pack('<I', iter)
        hash = hashlib.sha512(buffer).digest()
    return hash

def WordCalculateHash(password, salt):
    return CalculateHash(WordEncodePassword(password), binascii.a2b_base64(salt))

Using password "P@ssword" and the salt seen in the screenshot above, we can calculate the hash:

This calculated hash (BASE64 representation) is the same as the stored hash, thus the password is indeed "P@ssw0rd".

 

Didier Stevens
Senior handler
blog.DidierStevens.com

Display filters are used to define expressions that decide which packets get displayed, and which not in Wireshark's packet list.

Berkeley Packet Filter (BPF) expressions decide which packets get captured, and which not when Wireshark is capturing traffic.

Both expression types have a different syntax.

Wireshark release 4.4 brings a new feature to convert display filter expressions to BPF expressions.

Type your display filter expression into the display filter box, and then select this menu entry: Edit / Copy / Display filter as pcap filter.

The capture filter expression is put on the clipboard:

tcp dst port 443

If Wireshark can not convert an expression, the menu option will be grayed-out:

 

Didier Stevens
Senior handler
blog.DidierStevens.com