IBM i security — hackthelegacy.org

New release of hack400tool is there!

bart — Fri, 21 Jul 2017 17:53:11 +0000

Check out https://github.com/hackthelegacy/hack400tool and my Arsenal session at BlackHat 2017!

Hash generator for IBM System i hashes (DES, SHA-1) updated

bart — Sat, 03 Sep 2016 10:43:21 +0000

Our hash generator has been updated, see http://www.hackthelegacy.org/attachments/pwd400gen.py for new version. Updates 2016-09-03 - the DES algorithm has been updated, credits to @5up3rUs3r for finding the bugs. In case of passwords > 8 chars, AS/400 stores apparently both PW_TOKENa and PW_TOKENb (ref. RFC2877, 5.2) instead of the PW_TOKEN value (PW_TOKENa XOR PW_TOKENb) - some specific password/username combinations were causing overflow error in the DES algorithm. Fixed.

Our AS/400 SHA-1 hash format plugin for John the Ripper now included in the "bleeding jumbo" build!

bart — Wed, 24 Aug 2016 20:36:59 +0000

The John the Ripper module we have been working on is now officially included in John the Ripper bleeding Jumbo!  See https://github.com/magnumripper/JohnTheRipper ‘Our’ files: /src/as400_ssha1_fmt_plug.c /run/ibmiscanner2john.py /doc/README.IBM_AS400

New submit of hack400tool - check it out!

bart — Wed, 24 Aug 2016 17:34:41 +0000

We've been working quite recently on updating and adding new functionality to hack400tool. Today we submitted a new version on github. 2016-08-24 Updates Main changes: - temporary results are stored in sqlite database (better performance and stability) - support for SHA1 hash extraction for John the Ripper at ibmiscanner (see www.hackthelegacy.org for details) - other added options for ibmiscanner - minor GUI improvements (threading, progress bar) Check out at https://github.com/hackthelegacy/hack400tool !

Hash generator for IBM System i hashes (DES, SHA-1)

bart — Fri, 06 Nov 2015 10:57:15 +0000

For all those that want to use Python to crack the IBM System i hashes or just want to compare hashes, please check out the newest pwd400gen script available here: http://www.hackthelegacy.org/attachments/pwd400gen.py

Defcon23 slides are online!

bart — Sat, 08 Aug 2015 02:22:27 +0000

The DC23 slides used during the "Hack the legacy" session are available here: http://www.hackthelegacy.org/attachments/HackTheLegacy-DC23-final.pdf

It's official! Join my DefCon23 talk on IBM i hacking!

bart — Sun, 26 Apr 2015 15:56:26 +0000

See the details on https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Kulach