Handle signed/unsigned PDF permission P value for all PDF hash-modes

This commit is contained in:
Gabriele Gristina 2023-04-11 21:17:25 +02:00
parent 80fa78374e
commit cf3ab8e2dc
21 changed files with 310 additions and 224 deletions

View File

@ -20,22 +20,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -18,22 +18,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -18,22 +18,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -20,22 +20,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -18,22 +18,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -18,22 +18,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -30,22 +30,24 @@ CONSTANT_VK u32a padding[8] =
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -28,22 +28,24 @@ CONSTANT_VK u32a padding[8] =
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -28,22 +28,24 @@ CONSTANT_VK u32a padding[8] =
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -17,22 +17,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -19,22 +19,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -25,22 +25,24 @@
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;

View File

@ -38,6 +38,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf14_tmp

View File

@ -45,6 +45,7 @@
- Skip chained generated rules that exceed the maximum number of function calls
- Fixed incorrect plaintext check for 25400 and 26610. Increased plaintext check to 32 bytes to prevent false positives.
- Fixed bug in --stdout that caused certain rules to malfunction
- Handle signed/unsigned PDF permission P value for all PDF hash-modes
##
## Technical

View File

@ -44,22 +44,24 @@ const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig,
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
@ -214,6 +216,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -291,7 +297,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
{
const pdf_t *pdf = (const pdf_t *) esalt_buf;
const int line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
const int line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
40,

View File

@ -46,22 +46,24 @@ const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig,
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
@ -235,6 +237,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -312,7 +318,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
{
const pdf_t *pdf = (const pdf_t *) esalt_buf;
const int line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
const int line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
40,

View File

@ -45,22 +45,24 @@ const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig,
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
@ -222,6 +224,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -322,7 +328,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
const u8 *rc4key = (const u8 *) pdf->rc4key;
const int line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x:%02x%02x%02x%02x%02x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x:%02x%02x%02x%02x%02x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x:%02x%02x%02x%02x%02x";
const int line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
40,

View File

@ -45,22 +45,24 @@ const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig,
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
@ -245,6 +247,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -379,7 +385,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
if (pdf->id_len == 32)
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,
@ -416,7 +426,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
}
else
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,

View File

@ -51,22 +51,22 @@ const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig,
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
} pdf_t;

View File

@ -47,22 +47,22 @@ const char *module_st_pass (MAYBE_UNUSED const hashconfig_t *hashconfig,
typedef struct pdf
{
int V;
int R;
int P;
int V;
int R;
int P;
int enc_md;
int enc_md;
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
u32 id_buf[8];
u32 u_buf[32];
u32 o_buf[32];
int id_len;
int o_len;
int u_len;
int id_len;
int o_len;
int u_len;
u32 rc4key[2];
u32 rc4data[2];
u32 rc4key[2];
u32 rc4data[2];
} pdf_t;
@ -71,7 +71,7 @@ typedef struct pdf17l8_tmp
union
{
u32 dgst32[16];
u64 dgst64[8];
u64 dgst64[8];
} d;
u32 dgst_len;

View File

@ -69,6 +69,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf14_tmp
@ -354,6 +356,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -568,9 +574,14 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
int line_len = 0;
pdf_t *pdf = (pdf_t *) esalt_buf;
if (pdf->id_len == 32)
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,
@ -608,7 +619,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
}
else
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,