Radius fixes #5930
Radius fixes #5930
Conversation
Protect against invalid UTF-8 (now results in Unicode Replacement Characters). Use User-name for login field, if available. Fallback to radius client IP. Source and destination addresses are also always put in uid and gid fields, respectively.
Add a try/catch for DHCPv4 parsing. We were apparently using option field names that were added to Wireshark/tshark experimentally, and later renamed. Ubuntu 24.04 (Wireshark v4.2) had the old names, Ubuntu 25.04 (Wireshark v4.4) has the new names. We now try the newer version's field names first, then fallback to the older version's. For Radius and CHAP, adds source and destination ip addresses in uid and gid fields respectively, and hostname to GECOS if found.
In mode 1, crack all passwords immediately using a get_key() trick, but also try to avoid false positives (from incorrect shared key). Add a "cost" for mode [0=find secret 1=find password]. Also various optimizations and bug fixes.
solardiz
left a comment
solardiz
left a comment
There was a problem hiding this comment.
Not a full review, but I'm OK with these changes. Maybe also add a NEWS entry?
Also, it's a bit confusing when to use radius2john vs. the LUA script - do we have this documented?
Not sure it's worthy of a special mention, it's more of a "many other improvements and bugfixes" thing.
I found no documentation, I tried to understand the difference but I'm still confused because they should be essentially the same thing but they aren't. First of all, the tshark network2john.lua script produces hashes for the actual radius format while radius2john produces hashes for dynamic 1008, 1009 or 1017 formats, depending on type and salt length. They all mention the same whitepaper and its sections 3.1 and 3.3. BTW I guess one difference is you could run tshark "live" while radius2john is pcap only. What is disturbing is they produce different numbers of hashes from our samples. Not sure why. We should revisit this later and possibly write a README.radius or the like. Also, there are two versions of radius2john: one in Perl and one in Python. The Perl version is incomplete and outdated and spews out warnings. You even need to edit it for setting required options. I think we should just drop that one. |
2 participants
Fixes and tweaks for radius2john.py, network2john.lua and the Radius format itself.