Module Name: Adobe Hash Cracker
Module path: recon/credentials-credentials/adobe
Name: Adobe Hash Cracker
Author: Ethan Robish (@EthanRobish) and Tim Tomes (@LaNMaSteR53)
Decrypts hashes leaked from the 2013 Adobe breach. First, the module cross references the leak ID to identify Adobe hashes in the 'password' column of the 'creds' table, moves the Adobe hashes to the 'hash' column, and changes the 'type' to 'Adobe'. Second, the module attempts to crack the hashes by comparing the ciphertext's decoded cipher blocks to a local block lookup table (BLOCK_DB) of known cipher block values. Finally, the module updates the 'creds' table with the results based on the level of success.
||JSON file containing known Adobe cipher blocks and plaintext
||source of input (see 'show info' for details)
||SELECT DISTINCT hash FROM credentials WHERE hash IS NOT NULL AND password IS NULL AND type IS 'Adobe'
||string representing a single input
||path to a file containing a list of inputs
||database query returning one column of inputs
* Hash types supported: Adobe's base64 format
* Hash database from: http://stricture-group.com/files/adobe-top100.txt
* A completely padded password indicates that the exact length is known.