diff --git a/PSE/README.md b/PSE/README.md new file mode 100644 index 0000000..27b8a92 --- /dev/null +++ b/PSE/README.md @@ -0,0 +1,31 @@ +# SAP PSE samples + +These files are copied from [pysap](https://github.com/OWASP/pysap) test fixtures in +`pysap/tests/data/` and are kept byte-for-byte identical to those fixtures. +The SHA-256 values below can be used when synchronizing this directory: + +| File | SHA-256 | +| --- | --- | +| `pse_v2_lps_off_pbes1_3des_sha1.pse` | `8afbed5af0c4d2a1b8e91f2bcc77e9e9c2ee76b267461520f3d54c29eac0b25a` | +| `pse_v4_lps_off_pbes1_3des_sha1.pse` | `89074b5d67dda3fc163bcfd4f7aec776e9d7c05ecfe72a23123b19e830ad9f36` | + +The PIN for both PSE files is: + +```text +1234567980 +``` + +It is also available as a wordlist in `pin.txt` and can be used directly with +John after converting the samples. + +```bash +python3 john/run/pse2john.py -o pse2john-hashes.txt *.pse +john/run/john --format=pse --wordlist=pin.txt pse2john-hashes.txt +``` + +The two encrypted files produce these John-compatible hashes: + +```text +pse_v2_lps_off_pbes1_3des_sha1.pse:$pse$1$10000$8$77cb6908be860865$0$$16$24ee62740976ada0e7a41ade3552ee42::::: +pse_v4_lps_off_pbes1_3des_sha1.pse:$pse$1$10000$8$a4e5d94c81aea2fa$0$$20$c74899707d2a9ebdb50f4bd658c0e64379e3c4bb::::: +``` diff --git a/PSE/pin.txt b/PSE/pin.txt new file mode 100644 index 0000000..709d57d --- /dev/null +++ b/PSE/pin.txt @@ -0,0 +1 @@ +1234567980 diff --git a/PSE/pse_v2_lps_off_pbes1_3des_sha1.pse b/PSE/pse_v2_lps_off_pbes1_3des_sha1.pse new file mode 100755 index 0000000..9d2155b Binary files /dev/null and b/PSE/pse_v2_lps_off_pbes1_3des_sha1.pse differ diff --git a/PSE/pse_v4_lps_off_pbes1_3des_sha1.pse b/PSE/pse_v4_lps_off_pbes1_3des_sha1.pse new file mode 100755 index 0000000..3164e9a Binary files /dev/null and b/PSE/pse_v4_lps_off_pbes1_3des_sha1.pse differ