mod0keecrack.c

/*
 * Copyright (c) 2016, mod0keecrack
 *    Thorsten Schroeder <ths at modzero dot ch>
 *
 * All rights reserved.
 *
 * This file is part of mod0keecrack.
 *
 * "THE BEER-WARE LICENSE" (Revision 42):
 * Thorsten Schroeder <ths at modzero dot ch> wrote this file. As long as you
 * retain this notice you can do whatever you want with this stuff. If we meet
 * some day, and you think this stuff is worth it, you can buy me a beer in
 * return. Thorsten Schroeder.
 *
 * NON-MILITARY-USAGE CLAUSE
 * Redistribution and use in source and binary form for military use and
 * military research is not permitted. Infringement of these clauses may
 * result in publishing the source code of the utilizing applications and
 * libraries to the public. As this software is developed, tested and
 * reviewed by *international* volunteers, this clause shall not be refused
 * due to the matter of *national* security concerns.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE DDK PROJECT BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * File: mod0keecrack.c
 * Description: Implementation of a KeepassX 2 database password cracker.
 */



#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <string.h>
#include "helper.h"
#include "mod0keecrack.h"
#include "crypto.h"

static void usage(char *prog);
static char *kdbx_filename;

size_t kdbx_headerentries_free(m0_kdbx_header_entry_t *e)
{
  size_t i = 0;

  for(i=0; i<HEADERIDCOUNT;i++) {

    if(e[i].data != NULL) {
      free(e[i].data);
      memset(&e[i], 0, sizeof(m0_kdbx_header_entry_t));
    }
  }
  return i;
}

size_t kdbx_headerentries_read(FILE *kdbx_fd, m0_kdbx_header_entry_t *entries)
{
  size_t ret = 0;
  size_t result = 0;

  uint8_t id = 0;

  if (entries == NULL)
    return 0;

  do {

    // headers have variable lengths.
    // we need to read: [1 byte hdr-id] [1 word data-len] [data-len bytes of value]
    // if hdr-id == 0x00: header ends, encrypted payload starts.

    ret = fread(&id, sizeof(uint8_t), 1, kdbx_fd);

    if ( ret != 1)
      printf("[!] fread(id) failed.");

    if(id > HEADERIDCOUNT) {
      id = END;
      continue;
    }

    entries[id].id = id;

    ret = fread(&entries[id].len, sizeof(uint16_t), 1, kdbx_fd);

    if ( ret != 1)
      printf("[!] fread(hdrlen) failed.");

    entries[id].data = (uint8_t *)malloc(entries[id].len);

    if(entries[id].data == NULL) {
      printf("[!] malloc(entries[id].len) failed.");
      break;
    }

    ret = fread(entries[id].data, entries[id].len, 1, kdbx_fd);

    if ( ret != 1)
      printf("[!] fread(entries[%d].data) failed.", id);

    if( (id == 3) || (id==10) ) {
      memcpy(&entries[id].dw, entries[id].data, 4);
      memcpy(&entries[id].qw, entries[id].data, 4);
    } else if( id == 6 ) {
      memcpy(&entries[id].qw, entries[id].data, 8);
    }
    result++;

  } while (id != END);

  return result;
}

void kdbx_headerentries_dump(m0_kdbx_header_entry_t *h)
{
  printf("[*] kdbx headerentries:\n");
  printf("[-]    END:                 "); print_hex_buf(h[0].data, h[0].len); puts("");
  printf("[-]    COMMENT:             "); print_hex_buf(h[1].data, h[1].len); puts("");
  printf("[-]    CIPHERID:            "); print_hex_buf(h[2].data, h[2].len); puts("");
  printf("[-]    COMPRESSIONFLAGS:    %08x\n", h[3].dw );
  printf("[-]    MASTERSEED:          "); print_hex_buf(h[4].data, h[4].len); puts("");
  printf("[-]    TRANSFORMSEED:       "); print_hex_buf(h[5].data, h[5].len); puts("");
  printf("[-]    TRANSFORMROUNDS:     %016llx\n", h[6].qw );
  printf("[-]    ENCRYPTIONIV:        "); print_hex_buf(h[7].data, h[7].len); puts("");
  printf("[-]    PROTECTEDSTREAMKEY:  "); print_hex_buf(h[8].data, h[8].len); puts("");
  printf("[-]    STREAMSTARTBYTES:    "); print_hex_buf(h[9].data, h[9].len); puts("");
  printf("[-]    INNERRANDOMSTREAMID: %08x\n", h[10].dw );
  return;
}

size_t kdbx_header_read(FILE *kdbx_fd, m0_kdbx_header_t *header)
{
  size_t ret = 0;

  if (header == NULL)
    return 0;

  ret = fread(header, sizeof(m0_kdbx_header_t), 1, kdbx_fd);
  if ( ret != 1)
    printf("[!] fread(m0_kdbx_header) failed.");

  return ret;
}

void kdbx_header_dump(m0_kdbx_header_t h)
{
  printf("[*] kdbx header:\n");
  printf("[-]    file magic:          %08x\n", h.magic);
  printf("[-]    file identifier:     %08x\n", h.identifier);
  printf("[-]    file minor version:  %04x\n", (h.minor_version));
  printf("[-]    file major version:  %04x\n", (h.major_version));
  return;
}

size_t kdbx_payload_read(FILE *kdbx_fd, m0_kdbx_payload_t *p)
{
  size_t         ret = 0;
  size_t payload_len = 0;
  off_t    off_start = 0;
  off_t      off_end = 0;

  if (p == NULL)
    return 0;

  off_start = ftell(kdbx_fd);

  fseek(kdbx_fd, 0, SEEK_END);
  off_end = ftell(kdbx_fd);
  fseek(kdbx_fd, off_start, SEEK_SET);

  p->offset_start = off_start;
  p->len          = (off_end-off_start);
  p->encrypted    = (uint8_t *)malloc(p->len);

  if(p->encrypted == NULL) {
    printf("[!] malloc(payload->encrypted) failed.");
    return 0;
  }

  memset(p->encrypted, 0, p->len);

  ret = fread(p->encrypted, p->len, 1, kdbx_fd);
  if ( ret != 1)
    printf("[!] fread(payload) failed.");

  return ret;
}

void kdbx_payload_dump(m0_kdbx_payload_t p)
{
  printf("[*] kdbx payload:\n");
  printf("[-]    payload offset:      %llx\n", p.offset_start);
  printf("[-]    payload len:         %x\n", p.len);

  return;
}

bool kdbx_payload_crack(m0_kdbx_database_t *db, FILE *wordlist_fd)
{
  bool res = false;
  char pass[1024] = {0};
  FILE *keyfd = NULL;
  uint8_t *key_hash = NULL;
  uint8_t *key_data = NULL;
  size_t key_len = 0;
  int ret = 0;

  // if there is a file named <databasename>.key, we use this key in addition to the password.
  // otherwise, only the password is used to unlock the database.
  keyfd = fopen(kdbx_filename, "rb");

  if (!keyfd) {
    printf("[*] Not using keyfile\n");
    key_hash = NULL;
  } else {
    printf("[*] Using keyfile %s\n", kdbx_filename);
    key_hash = (uint8_t *)malloc(32);
    if(!key_hash) {
      printf("[!] key_hash = malloc(32) failed.");
      return false;
    }

    fseek(keyfd, 0, SEEK_END);
    key_len = ftell(keyfd);
    fseek(keyfd, 0, SEEK_SET);
    key_data = (uint8_t *)malloc(key_len);

    if(!key_data) {
      printf("[!] key_data = malloc(%d) failed.", key_len);
      return false;
    }

    ret = fread(key_data, key_len, 1, keyfd);

    if ( ret != 1)
      printf("[!] fread(key_data) failed.");

    sha256_hash(key_hash, key_data, key_len);
    printf("[+] key hash:               "); print_hex_buf(key_hash, 32); puts("");
  }

  printf("[*] kdbx crack:\n");

  if( wordlist_fd == NULL )
    return false;

  while( fgets(pass, sizeof(pass), wordlist_fd) ) {
    int len = strlen(pass);
    if(len > 0)
      pass[len-1] = 0x00;

    res = kdbx_decrypt_payload(db, pass, key_hash);
    if(res) {
      printf("[*] decryption successful with password %s\n", pass);
      break;
    }
  }

  return res;
}

bool kdbx_decrypt_payload(m0_kdbx_database_t *db, char *pass, uint8_t *key_hash)
{
  bool res = false;
  uint8_t           hash[32] = {0};
  uint8_t  composite_key[32] = {0};
  uint8_t composite_data[64] = {0};
  uint8_t  transform_key[32] = {0};
  uint8_t     master_key[32] = {0};
  uint8_t   *masterkey_input = NULL;
  size_t masterkey_input_len = 0;

  m0_kdbx_header_entry_t *hdr = &db->kdbxheader;

  memset(composite_data, 0, 64);
  memset(transform_key, 0, 32);
  memset(master_key, 0, 32);

  printf("[+] trying: %s\r", pass);

  sha256_hash(hash, pass, strlen(pass));

  if(key_hash == NULL) {
    sha256_hash(composite_key, hash, sizeof(hash));
  } else {
    memcpy(composite_data, hash, sizeof(hash));
    memcpy(composite_data+sizeof(hash), key_hash, sizeof(composite_data)-sizeof(hash));
    sha256_hash(composite_key, composite_data, sizeof(composite_data));
  }

  memcpy(transform_key, composite_key, sizeof(transform_key));

  // aes_transformkey() is platform specific.
  // For Windows, CNG is used and implemented in crypto-ms.c
  aes_transformkey(&db->kdbxheader, transform_key, sizeof(transform_key));

  sha256_hash(transform_key, transform_key, sizeof(transform_key));

  masterkey_input_len = sizeof(transform_key) + hdr[MASTERSEED].len;
  masterkey_input     = (uint8_t *)malloc(masterkey_input_len);

  if(masterkey_input_len < hdr[MASTERSEED].len) {
    // should never happen, as masterkey len is (currently) 16 bit
    puts("[!] masterkey_input len integer overflow.");
    return 0;
  }
  memcpy(masterkey_input, hdr[MASTERSEED].data, hdr[MASTERSEED].len);
  memcpy(masterkey_input+hdr[MASTERSEED].len, transform_key, sizeof(transform_key));

  sha256_hash(master_key, masterkey_input, masterkey_input_len);

  // aes_decrypt_check() is platform specific.
  // For Windows, CNG is used and implemented in crypto-ms.c
  res = aes_decrypt_check(hdr, master_key, &db->payload);

  return res;
}

int main(int ac, char** av)
{
  FILE *kdbx_fd = NULL;
  FILE *wordlist_fd = NULL;

  char *kdbx_path = NULL;
  char *tmp = NULL;
  char *wordlist_path = NULL;
  size_t filename_len = 0;

  m0_kdbx_database_t      kdbx_db = {0};

  if(ac < 2)
    usage(av[0]);
  else if(ac > 2) {
    // wordlist from file
    wordlist_path = av[2];
  } else {
    // wordlist == stdin
  }

  memset(&kdbx_db, 0, sizeof(kdbx_db));

  kdbx_path = av[1];
  filename_len = strlen(kdbx_path);
  kdbx_filename = (char *) malloc(filename_len + 5);
  memset(kdbx_filename, 0, filename_len+5);

  if(filename_len > filename_len+5)
    exit(1);

  memcpy(kdbx_filename, kdbx_path, filename_len);
  tmp = strrchr(kdbx_filename, '.');

  if(tmp)
    memcpy(tmp, ".key\x00", 5);
  else
    strcat(kdbx_filename, ".key");

  printf("[*] using  db: %s\n[*] using key: %s\n", kdbx_path, kdbx_filename);

  kdbx_fd = fopen(kdbx_path, "rb");

  if (!kdbx_fd) {
    printf("[!] Can't open kdbx %s\n", kdbx_path);
    exit(2);
  }

  if(wordlist_path) {
    wordlist_fd = fopen(wordlist_path, "r");
    if (!wordlist_fd) {
      printf("[!] Can't open wordlist %s\n", wordlist_path);
      exit(2);
    }
  } else {
    wordlist_fd = stdin; //fdopen(stdin, "r");
    if (!wordlist_fd) {
      printf("[!] Can't open wordlist from stdin\n");
      exit(2);
    }
  }

  kdbx_header_read(kdbx_fd, &kdbx_db.fileheader);
  kdbx_header_dump(kdbx_db.fileheader);

  kdbx_headerentries_read(kdbx_fd, &kdbx_db.kdbxheader);
  kdbx_headerentries_dump(&kdbx_db.kdbxheader);

  kdbx_payload_read(kdbx_fd, &kdbx_db.payload);
  kdbx_payload_dump(kdbx_db.payload);

  kdbx_payload_crack(&kdbx_db, wordlist_fd);

  kdbx_headerentries_free(&kdbx_db.kdbxheader);
  fclose(kdbx_fd);
  exit(0);
}

static void usage(char *prog)
{
  printf("[+] usage: %s <keepassx-file.kdbx> ...\n", prog);
  exit(1);
}