Skip to content

Commit 2510580

Browse files
committed
Land rapid7#2784 - Remove EOL whitespace from OS X hashdump
2 parents 0db062a + 9434d60 commit 2510580

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

modules/post/osx/gather/hashdump.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -57,19 +57,19 @@ def run
5757
# on 10.8+ ShadowHashData stores a binary plist inside of the user.plist
5858
# Here we pull out the binary plist bytes and use built-in plutil to convert to xml
5959
plist_bytes = shadow_bytes.split('').each_slice(2).map{|s| "\\x#{s[0]}#{s[1]}"}.join
60-
60+
6161
# encode the bytes as \x hex string, print using bash's echo, and pass to plutil
6262
shadow_plist = cmd_exec("/bin/bash -c 'echo -ne \"#{plist_bytes}\" | plutil -convert xml1 - -o -'")
63-
63+
6464
# read the plaintext xml
6565
shadow_xml = REXML::Document.new(shadow_plist)
66-
66+
6767
# parse out the different parts of sha512pbkdf2
6868
dict = shadow_xml.elements[1].elements[1].elements[2]
6969
entropy = Rex::Text.to_hex(dict.elements[2].text.gsub(/\s+/, '').unpack('m*')[0], '')
7070
iterations = dict.elements[4].text.gsub(/\s+/, '')
7171
salt = Rex::Text.to_hex(dict.elements[6].text.gsub(/\s+/, '').unpack('m*')[0], '')
72-
72+
7373
# PBKDF2 stored in <user, iterations, salt, entropy> format
7474
decoded_hash = "#{user}:$ml$#{iterations}$#{salt}$#{entropy}"
7575
print_good "SHA512:#{decoded_hash}"
@@ -164,7 +164,7 @@ def lion?
164164
def lte_tiger?
165165
ver_num =~ /10\.(\d+)/ and $1.to_i <= 4
166166
end
167-
167+
168168
# parse the dslocal plist in lion
169169
def read_ds_xml_plist(plist_content)
170170
doc = REXML::Document.new(plist_content)

0 commit comments

Comments
 (0)