Add support for the new hashline (hashcat -m 22000)
@@ -91,9 +91,32 @@ def parse_pmkid(pmkid):
return res
+def parse_combined(hashline):
+ '''m22000 hashline decompose
+
+ format:
+ SIGNATURE*TYPE*PMKID/MIC*MACAP*MACSTA*ESSID*ANONCE*EAPOL*MESSAGEPAIR
+ '''
+
+ arr = hashline.split(b'*', 9)
+ res = ''
+ if len(arr) == 9:
+ try:
+ if args.t == 'essid':
+ res = binascii.unhexlify(arr[5].strip())
+ elif args.t == 'mac_ap':
+ res = arr[3]
+ elif args.t == 'mac_sta':
+ res = arr[4]
+ except TypeError as ex:
+ sys.stderr.write(str(ex + '\n'))
+ exit(1)
+
+ return res
+
if __name__ == "__main__":
parser = argparse.ArgumentParser(
- description='Extract records from hccapx/pmkid file based on regexp')
+ description='Extract records from wpa combined hashline/hccapx/pmkid file based on regexp')
#group = parser.add_mutually_exclusive_group(required=True)
parser.add_argument(
'-f', '--file', type=argparse.FileType('r'),
@@ -147,7 +170,10 @@ if __name__ == "__main__":
structformat = ''
while True:
buf = fd.read(4)
- if buf == 'HCPX':
+ if buf == 'WPA*':
+ buf = buf + fd.readline()
+ structformat = 'combined'
+ elif buf == 'HCPX':
buf = buf + fd.read(393 - 4)
structformat = 'hccapx'
else:
@@ -157,7 +183,9 @@ if __name__ == "__main__":
if not buf:
break
- if structformat == 'hccapx':
+ if structformat == 'combined':
+ target = parse_combined(buf)
+ elif structformat == 'hccapx':
target = parse_hccapx(buf)
elif structformat == 'pmkid':
target = parse_pmkid(buf)
