From 6b686681d5e7fba0863151ddcd9dcd2302ca64c2 Mon Sep 17 00:00:00 2001 From: bwhitn Date: Mon, 19 Nov 2018 23:48:33 -0500 Subject: [PATCH 1/3] Encoding ctx1 --- src/core/config/Categories.json | 1 + src/core/operations/EncodeCitrixCTX1.mjs | 50 ++++++++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 src/core/operations/EncodeCitrixCTX1.mjs diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json index 1891c460..f317e9a1 100755 --- a/src/core/config/Categories.json +++ b/src/core/config/Categories.json @@ -66,6 +66,7 @@ "Blowfish Decrypt", "DES Encrypt", "DES Decrypt", + "Citrix CTX1 Encode", "Triple DES Encrypt", "Triple DES Decrypt", "RC2 Encrypt", diff --git a/src/core/operations/EncodeCitrixCTX1.mjs b/src/core/operations/EncodeCitrixCTX1.mjs new file mode 100644 index 00000000..c0a42b18 --- /dev/null +++ b/src/core/operations/EncodeCitrixCTX1.mjs @@ -0,0 +1,50 @@ +/** + * @author n1474335 [n1474335@gmail.com] + * @copyright Crown Copyright 2017 + * @license Apache-2.0 + */ + +import Operation from "../Operation"; +import cptable from "../vendor/js-codepage/cptable.js"; + +/** + * Encode Citrix CTX1 class + */ +class EncodeCitrixCTX1 extends Operation { + + /** + * EncodeCitrixCTX1 constructor + */ + constructor() { + super(); + + this.name = "Citrix CTX1 Encode"; + this.module = "Ciphers"; + this.description = "Encodes strings to Citrix CTX1 password format."; + this.infoURL = "https://www.reddit.com/r/AskNetsec/comments/1s3r6y/citrix_ctx1_hash_decoding/"; + this.inputType = "string"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + */ + run(input, args) { + let utf16pass = Buffer.from(cptable.utils.encode(1200, input)); + let result = []; + let temp = 0 + for (let i = 0; i < utf16pass.length; i++) { + temp = utf16pass[i] ^ 0xa5 ^ temp; + result.push(((temp >> 4) & 0xf) + 0x41); + result.push((temp & 0xf) + 0x41); + } + + return new TextDecoder("utf-8").decode(Buffer.from(result)); + } + +} + +export default EncodeCitrixCTX1; From 215e7a5f5db32f416b3c606adfc788315851742c Mon Sep 17 00:00:00 2001 From: Brian Whitney Date: Tue, 20 Nov 2018 11:09:52 -0500 Subject: [PATCH 2/3] Citrix CTX1 encoding/decoding --- src/core/config/Categories.json | 1 + src/core/operations/DecodeCitrixCTX1.mjs | 57 ++++++++++++++++++++++++ src/core/operations/EncodeCitrixCTX1.mjs | 12 ++--- test/tests/operations/Ciphers.mjs | 33 ++++++++++++++ 4 files changed, 97 insertions(+), 6 deletions(-) create mode 100644 src/core/operations/DecodeCitrixCTX1.mjs diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json index f317e9a1..158f3f76 100755 --- a/src/core/config/Categories.json +++ b/src/core/config/Categories.json @@ -67,6 +67,7 @@ "DES Encrypt", "DES Decrypt", "Citrix CTX1 Encode", + "Citrix CTX1 Decode", "Triple DES Encrypt", "Triple DES Decrypt", "RC2 Encrypt", diff --git a/src/core/operations/DecodeCitrixCTX1.mjs b/src/core/operations/DecodeCitrixCTX1.mjs new file mode 100644 index 00000000..af7fa035 --- /dev/null +++ b/src/core/operations/DecodeCitrixCTX1.mjs @@ -0,0 +1,57 @@ +/** + * @author bwhitn [brian.m.whitney@gmail.com] + * @copyright Crown Copyright 2017 + * @license Apache-2.0 + */ + +import Operation from "../Operation"; +import cptable from "../vendor/js-codepage/cptable.js"; + +/** + * Encode Citrix CTX1 class + */ +class DecodeCitrixCTX1 extends Operation { + + /** + * EncodeCitrixCTX1 constructor + */ + constructor() { + super(); + + this.name = "Citrix CTX1 Decode"; + this.module = "Ciphers"; + this.description = "Decodes strings in a Citrix CTX1 password format to plaintext."; + this.infoURL = "https://www.reddit.com/r/AskNetsec/comments/1s3r6y/citrix_ctx1_hash_decoding/"; + this.inputType = "byteArray"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {byteArray} input + * @param {Object[]} args + * @returns {string} + */ + run(input, args) { + if (input.length % 4 != 0) { + return ""; + } + let revinput = input.reverse(); + let result = []; + let temp = 0; + for (let i = 0; i < revinput.length; i+=2) { + if (i+2 >= revinput.length) { + temp = 0; + } else { + temp = ((revinput[i + 2] - 0x41) & 0xf) ^ (((revinput[i + 3]- 0x41) << 4) & 0xf0); + } + temp = (((revinput[i] - 0x41) & 0xf) ^ (((revinput[i + 1] - 0x41) << 4) & 0xf0)) ^ 0xa5 ^ temp; + result.push(temp); + } + // Decodes a utf-16le string + return cptable.utils.decode(1200, result.reverse()); + } + +} + +export default DecodeCitrixCTX1; diff --git a/src/core/operations/EncodeCitrixCTX1.mjs b/src/core/operations/EncodeCitrixCTX1.mjs index c0a42b18..ad90b559 100644 --- a/src/core/operations/EncodeCitrixCTX1.mjs +++ b/src/core/operations/EncodeCitrixCTX1.mjs @@ -1,5 +1,5 @@ /** - * @author n1474335 [n1474335@gmail.com] + * @author bwhitn [brian.m.whitney@gmail.com] * @copyright Crown Copyright 2017 * @license Apache-2.0 */ @@ -23,26 +23,26 @@ class EncodeCitrixCTX1 extends Operation { this.description = "Encodes strings to Citrix CTX1 password format."; this.infoURL = "https://www.reddit.com/r/AskNetsec/comments/1s3r6y/citrix_ctx1_hash_decoding/"; this.inputType = "string"; - this.outputType = "string"; + this.outputType = "byteArray"; this.args = []; } /** * @param {string} input * @param {Object[]} args - * @returns {string} + * @returns {byteArray} */ run(input, args) { let utf16pass = Buffer.from(cptable.utils.encode(1200, input)); let result = []; - let temp = 0 + let temp = 0; for (let i = 0; i < utf16pass.length; i++) { temp = utf16pass[i] ^ 0xa5 ^ temp; - result.push(((temp >> 4) & 0xf) + 0x41); + result.push(((temp >>> 4) & 0xf) + 0x41); result.push((temp & 0xf) + 0x41); } - return new TextDecoder("utf-8").decode(Buffer.from(result)); + return result; } } diff --git a/test/tests/operations/Ciphers.mjs b/test/tests/operations/Ciphers.mjs index 553216ef..ad69b6a5 100644 --- a/test/tests/operations/Ciphers.mjs +++ b/test/tests/operations/Ciphers.mjs @@ -220,6 +220,39 @@ TestRegister.addTests([ } ], }, + { + name: "Citrix CTX1 Encode", + input: "Password1", + expectedOutput: "PFFAJEDBOHECJEDBODEGIMCJPOFLJKDPKLAO", + recipeConfig: [ + { + "op": "Citrix CTX1 Encode", + "args": [] + } + ], + }, + { + name: "Citrix CTX1 Decode: normal", + input: "PFFAJEDBOHECJEDBODEGIMCJPOFLJKDPKLAO", + expectedOutput: "Password1", + recipeConfig: [ + { + "op": "Citrix CTX1 Decode", + "args": [] + } + ], + }, + { + name: "Citrix CTX1 Decode: invalid length", + input: "PFFAJEDBOHECJEDBODEGIMCJPOFLJKDPKLA", + expectedOutput: "", + recipeConfig: [ + { + "op": "Citrix CTX1 Decode", + "args": [] + } + ], + }, { name: "Vigenère Encode: no input", input: "", From c378bcb00b0c5e79ecd00bd8619532bd680206db Mon Sep 17 00:00:00 2001 From: Brian Whitney Date: Tue, 20 Nov 2018 11:24:50 -0500 Subject: [PATCH 3/3] Fixed lint issues --- src/core/operations/DecodeCitrixCTX1.mjs | 6 +++--- src/core/operations/EncodeCitrixCTX1.mjs | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/core/operations/DecodeCitrixCTX1.mjs b/src/core/operations/DecodeCitrixCTX1.mjs index af7fa035..05407347 100644 --- a/src/core/operations/DecodeCitrixCTX1.mjs +++ b/src/core/operations/DecodeCitrixCTX1.mjs @@ -33,11 +33,11 @@ class DecodeCitrixCTX1 extends Operation { * @returns {string} */ run(input, args) { - if (input.length % 4 != 0) { + if (input.length % 4 !== 0) { return ""; } - let revinput = input.reverse(); - let result = []; + const revinput = input.reverse(); + const result = []; let temp = 0; for (let i = 0; i < revinput.length; i+=2) { if (i+2 >= revinput.length) { diff --git a/src/core/operations/EncodeCitrixCTX1.mjs b/src/core/operations/EncodeCitrixCTX1.mjs index ad90b559..26021f16 100644 --- a/src/core/operations/EncodeCitrixCTX1.mjs +++ b/src/core/operations/EncodeCitrixCTX1.mjs @@ -33,8 +33,8 @@ class EncodeCitrixCTX1 extends Operation { * @returns {byteArray} */ run(input, args) { - let utf16pass = Buffer.from(cptable.utils.encode(1200, input)); - let result = []; + const utf16pass = Buffer.from(cptable.utils.encode(1200, input)); + const result = []; let temp = 0; for (let i = 0; i < utf16pass.length; i++) { temp = utf16pass[i] ^ 0xa5 ^ temp;