Skip to content

Commit fd67a1d

Browse files
SaiSakthidarSaiSakthidar
committed
Remove CAIN
1 parent 3547984 commit fd67a1d

File tree

13 files changed

+3
-191
lines changed

13 files changed

+3
-191
lines changed

‎documentation/modules/auxiliary/server/capture/mysql.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,6 @@ This module creates a mock MySQL server which accepts credentials. Upon receivi
1616

1717
Write a file containing a John the Ripper format for cracking the credentials. Default is ``.
1818

19-
### CAINPWFILE
20-
21-
Write a file containing a Cain & Abel format for cracking the credentials. Default is ``.
22-
2319
### SRVVERSION
2420

2521
The MySQL version to print in the login banner. Default is `5.5.16`.

‎documentation/modules/auxiliary/server/capture/smb.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@ Microsoft provides an article on how to detect, disable, and enable SMB in vario
1818

1919
## Options
2020

21-
### CAINPWFILE
22-
23-
A file to store Cain & Abel formatted captured hashes in. Only supports NTLMv1 Hashes.
24-
2521
### CHALLENGE
2622

2723
The 8 byte server challenge. If unset or not a valid 16 character hexadecimal pattern, a random challenge is used instead.

‎documentation/modules/auxiliary/server/relay/smb_to_ldap.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -82,10 +82,6 @@ msfconsole server (see an example below).
8282

8383
Target address range or CIDR identifier to relay to.
8484

85-
### CAINPWFILE
86-
87-
A file to store Cain & Abel formatted captured hashes in. Only supports NTLMv1 Hashes.
88-
8985
### JOHNPWFILE
9086

9187
A file to store John the Ripper formatted hashes in. NTLMv1 and NTLMv2 hashes

‎documentation/modules/auxiliary/server/relay/smb_to_mssql.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,6 @@ Example steps in this format (is also in the PR):
2323

2424
Target address range or CIDR identifier to relay to.
2525

26-
### CAINPWFILE
27-
28-
A file to store Cain & Abel formatted captured hashes in. Only supports NTLMv1 Hashes.
29-
3026
### JOHNPWFILE
3127

3228
A file to store John the Ripper formatted hashes in. NTLMv1 and NTLMv2 hashes

‎documentation/modules/exploit/windows/smb/smb_relay.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,10 +79,6 @@ flowchart LR
7979

8080
Target address range or CIDR identifier to relay to
8181

82-
### CAINPWFILE
83-
84-
A file to store Cain & Abel formatted captured hashes in. Only supports NTLMv1 Hashes.
85-
8682
### JOHNPWFILE
8783

8884
A file to store John the Ripper formatted hashes in. NTLMv1 and NTLMv2 hashes will be stored in separate files.

‎lib/msf/core/exploit/remote/smb/server/hash_capture.rb‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ def initialize(info = {})
1616

1717
register_options(
1818
[
19-
OptString.new('CAINPWFILE', [false, 'Name of file to store Cain&Abel hashes in. Only supports NTLMv1 hashes. Can be a path.', nil]),
2019
OptString.new('JOHNPWFILE', [false, 'Name of file to store JohnTheRipper hashes in. Supports NTLMv1 and NTLMv2 hashes, each of which is stored in separate files. Can also be a path.', nil])
2120
], self.class)
2221
end
@@ -35,11 +34,6 @@ def validate_smb_hash_capture_datastore(datastore, ntlm_provider)
3534
print_status("#{build_jtr_file_name(Metasploit::Framework::Hashes::JTR_NTLMV2)} for NTLMv2 hashes.")
3635
print_line
3736
end
38-
39-
if datastore['CAINPWFILE']
40-
print_status("Cain & Abel hashes will be stored at #{File.expand_path(datastore['CAINPWFILE'], Msf::Config.install_root)}")
41-
print_line
42-
end
4337
end
4438

4539
def report_ntlm_type3(address:, ntlm_type1:, ntlm_type2:, ntlm_type3:)
@@ -140,15 +134,6 @@ def report_ntlm_type3(address:, ntlm_type1:, ntlm_type2:, ntlm_type3:)
140134
f.puts(combined_hash)
141135
end
142136
end
143-
144-
# Cain & Abel doesn't support import of NTLMv2 hashes
145-
if datastore['CAINPWFILE'] && jtr_format == Metasploit::Framework::Hashes::JTR_NTLMV1
146-
# Cain&Abel hash format
147-
# Username:Domain:Challenge:LMHash:NTLMHash
148-
File.open(File.expand_path(datastore['CAINPWFILE'], Msf::Config.install_root), 'ab') do |f|
149-
f.puts("#{user}:#{domain}:#{server_challenge}:#{client_hash}")
150-
end
151-
end
152137
end
153138

154139
def on_ntlm_type3(address:, ntlm_type1:, ntlm_type2:, ntlm_type3:)

‎modules/auxiliary/server/capture/http_ntlm.rb‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,6 @@ def initialize(info = {})
3939
)
4040

4141
register_options([
42-
# OptString.new('LOGFILE', [ false, "The local filename to store the captured hashes", nil ]),
43-
OptString.new('CAINPWFILE', [ false, 'The local filename to store the hashes in Cain&Abel format', nil ]),
4442
OptString.new('JOHNPWFILE', [ false, 'The prefix to the local filename to store the hashes in JOHN format', nil ]),
4543
OptString.new('CHALLENGE', [ true, 'The 8 byte challenge ', '1122334455667788' ])
4644

@@ -308,8 +306,6 @@ def html_get_hash(arg = {})
308306
"NTHASH:#{nt_hash || '<NULL>'} " \
309307
"NT_CLIENT_CHALLENGE:#{nt_cli_challenge || '<NULL>'}\n"
310308
when NTLM_CONST::NTLM_2_SESSION_RESPONSE
311-
# we can consider those as netv1 has they have the same size and i cracked the same way by cain/jtr
312-
# also 'real' netv1 is almost never seen nowadays except with smbmount or msf server capture
313309
capturelogmessage =
314310
"#{capturedtime}\nNTLM2_SESSION Response Captured from #{host} \n" \
315311
"DOMAIN: #{domain} USER: #{user} \n" \
@@ -338,24 +334,6 @@ def html_get_hash(arg = {})
338334

339335
report_creds(opts_report)
340336

341-
# if(datastore['LOGFILE'])
342-
# File.open(datastore['LOGFILE'], "ab") {|fd| fd.puts(capturelogmessage + "\n")}
343-
# end
344-
345-
if datastore['CAINPWFILE'] && user && ((ntlm_ver == NTLM_CONST::NTLM_V1_RESPONSE) || (ntlm_ver == NTLM_CONST::NTLM_2_SESSION_RESPONSE))
346-
fd = File.open(datastore['CAINPWFILE'], 'ab')
347-
fd.puts(
348-
[
349-
user,
350-
domain || 'NULL',
351-
@challenge.unpack('H*')[0],
352-
lm_hash || '0' * 48,
353-
nt_hash || '0' * 48
354-
].join(':').gsub(/\n/, '\\n')
355-
)
356-
fd.close
357-
end
358-
359337
if datastore['JOHNPWFILE'] && user
360338
case ntlm_ver
361339
when NTLM_CONST::NTLM_V1_RESPONSE, NTLM_CONST::NTLM_2_SESSION_RESPONSE

‎modules/auxiliary/server/capture/mssql.rb‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,6 @@ def initialize
4646
register_options(
4747
[
4848
OptPort.new('SRVPORT', [ true, 'The local port to listen on.', 1433 ]),
49-
OptString.new('CAINPWFILE', [ false, 'The local filename to store the hashes in Cain&Abel format', nil ]),
5049
OptString.new('JOHNPWFILE', [ false, 'The prefix to the local filename to store the hashes in JOHN format', nil ]),
5150
OptString.new('CHALLENGE', [ true, 'The 8 byte challenge ', '1122334455667788' ])
5251
]
@@ -258,8 +257,6 @@ def mssql_get_hash(arg = {})
258257
"NTHASH:#{nt_hash || '<NULL>'} " \
259258
"NT_CLIENT_CHALLENGE:#{nt_cli_challenge || '<NULL>'}\n"
260259
when NTLM_CONST::NTLM_2_SESSION_RESPONSE
261-
# we can consider those as netv1 has they have the same size and i cracked the same way by cain/jtr
262-
# also 'real' netv1 is almost never seen nowadays except with smbmount or msf server capture
263260
smb_db_type_hash = Metasploit::Framework::Hashes::JTR_NTLMV1
264261
capturelogmessage =
265262
"#{capturedtime}\nNTLM2_SESSION Response Captured from #{host} \n" \
@@ -273,10 +270,6 @@ def mssql_get_hash(arg = {})
273270

274271
print_status(capturelogmessage)
275272

276-
# DB reporting
277-
# Rem : one report it as a smb_challenge on port 445 has breaking those hashes
278-
# will be mainly use for psexec / smb related exploit
279-
280273
jtr_hash = case smb_db_type_hash
281274
when Metasploit::Framework::Hashes::JTR_NTLMV2
282275
user + '::' + domain + ':' + datastore['CHALLENGE'].to_s + ':' + nt_hash + ':' + nt_cli_challenge.to_s
@@ -294,23 +287,6 @@ def mssql_get_hash(arg = {})
294287
type: :nonreplayable_hash,
295288
jtr_format: smb_db_type_hash
296289
)
297-
# if(datastore['LOGFILE'])
298-
# File.open(datastore['LOGFILE'], "ab") {|fd| fd.puts(capturelogmessage + "\n")}
299-
# end
300-
301-
if datastore['CAINPWFILE'] && user && ((ntlm_ver == NTLM_CONST::NTLM_V1_RESPONSE) || (ntlm_ver == NTLM_CONST::NTLM_2_SESSION_RESPONSE))
302-
fd = File.open(datastore['CAINPWFILE'], 'ab')
303-
fd.puts(
304-
[
305-
user,
306-
domain || 'NULL',
307-
@challenge.unpack('H*')[0],
308-
lm_hash || '0' * 48,
309-
nt_hash || '0' * 48
310-
].join(':').gsub(/\n/, '\\n')
311-
)
312-
fd.close
313-
end
314290

315291
if datastore['JOHNPWFILE'] && user
316292
case ntlm_ver

‎modules/auxiliary/server/capture/mysql.rb‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ def initialize
1313
'Description' => %q{
1414
This module provides a fake MySQL service that is designed to
1515
capture authentication credentials. It captures challenge and
16-
response pairs that can be supplied to Cain or JtR for cracking.
16+
response pairs that can be supplied to JtR for cracking.
1717
},
1818
'Author' => 'Patrik Karlsson <patrik[at]cqure.net>',
1919
'License' => MSF_LICENSE,
@@ -27,7 +27,6 @@ def initialize
2727
OptPort.new('SRVPORT', [ true, 'The local port to listen on.', 3306 ]),
2828
OptString.new('CHALLENGE', [ true, 'The 16 byte challenge', '112233445566778899AABBCCDDEEFF1122334455' ]),
2929
OptString.new('SRVVERSION', [ true, 'The server version to report in the greeting response', '5.5.16' ]),
30-
OptString.new('CAINPWFILE', [ false, 'The local filename to store the hashes in Cain&Abel format', nil ]),
3130
OptString.new('JOHNPWFILE', [ false, 'The prefix to the local filename to store the hashes in JOHN format', nil ]),
3231
]
3332
)
@@ -178,20 +177,6 @@ def on_client_data(client)
178177
proof: info[:database] || hash_line
179178
)
180179

181-
if datastore['CAINPWFILE']
182-
fd = ::File.open(datastore['CAINPWFILE'], 'ab')
183-
fd.puts(
184-
[
185-
info[:username],
186-
'NULL',
187-
info[:response].unpack('H*')[0],
188-
@challenge.unpack('H*')[0],
189-
'SHA1'
190-
].join("\t").gsub(/\n/, '\\n')
191-
)
192-
fd.close
193-
end
194-
195180
if datastore['JOHNPWFILE']
196181
john_hash_line = "#{info[:username]}:$mysqlna$#{@challenge.unpack('H*')[0]}*#{info[:response].unpack('H*')[0]}"
197182
fd = ::File.open(datastore['JOHNPWFILE'] + '_mysqlna', 'ab')

‎modules/auxiliary/server/capture/sip.rb‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def initialize
1515
'Description' => %q{
1616
This module provides a fake SIP service that is designed to
1717
capture authentication credentials. It captures challenge and
18-
response pairs that can be supplied to Cain or JtR for cracking.
18+
response pairs that can be supplied to JtR for cracking.
1919
},
2020
'Author' => 'Patrik Karlsson <patrik[at]cqure.net>',
2121
'License' => MSF_LICENSE,
@@ -35,7 +35,6 @@ def initialize
3535
OptAddress.new('SRVHOST', [ true, 'The local host to listen on.', '0.0.0.0' ]),
3636
OptString.new('NONCE', [ true, 'The server byte nonce', '1234' ]),
3737
OptString.new('JOHNPWFILE', [ false, 'The prefix to the local filename to store the hashes in JOHN format', nil ]),
38-
OptString.new('CAINPWFILE', [ false, 'The local filename to store the hashes in Cain&Abel format', nil ]),
3938
]
4039
)
4140
register_advanced_options(
@@ -206,22 +205,6 @@ def run
206205
fd.close
207206
end
208207

209-
if datastore['CAINPWFILE']
210-
resp = []
211-
resp << auth_tokens['realm']
212-
resp << auth_tokens['username']
213-
resp << ''
214-
resp << request[:uri]
215-
resp << auth_tokens['nonce']
216-
resp << response
217-
resp << method
218-
resp << algorithm
219-
220-
fd = File.open(datastore['CAINPWFILE'], 'ab')
221-
fd.puts resp.join("\t") + "\r\n"
222-
fd.close
223-
end
224-
225208
end
226209
sip_send_error_message(request, 401, 'Unauthorized')
227210
when 'ACK'

0 commit comments

Comments
 (0)