哈希长度扩展攻击(Hash Length Extension Attack)利用工具hexpand安装使用方法

去年我写了一篇哈希长度扩展攻击的简介以及HashPump安装使用方法，本来已经足够了，但HashPump还不是很完善的哈希长度扩展攻击，HashPump在使用的时候必须提供original_data，近来的哈希长度扩展攻击的题目已经不提供original_data，从原理上来说也不一定需要这个original_data，所以今年pcat又来写一篇hexpand的安装使用方法，鉴于时间关系，本人只在kali、Ubuntu14.04下测试。

0x01 安装pkg-config

https://pkg-config.freedesktop.org/releases/

目前最新版pkg-config-0.29.2.tar.gz

v=0.29.2
wget https://pkg-config.freedesktop.org/releases/pkg-config-${v}.tar.gz
tar -xzvf pkg-config-${v}.tar.gz
cd pkg-config-${v}/
./configure --with-internal-glib && make && make install

0x02 安装OpenSSL开发包

apt-get update
apt-get install -y libssl-dev

新版kali里这样安装openssl是不行的，参考下面第7点。

0x03 hexpand的安装

git clone https://github.com/amlweems/hexpand
cd hexpand
make

0x04 报错Package openssl was not found in the pkg-config search path.

搜索本机pkgconfig文件夹的openssl.pc、libssl.pc、libcrypto.pc，并将这3个文件复制到/usr/lib/pkgconfig/（如果不存在就新建个）下，然后

export PKG_CONFIG_PATH=/usr/lib/pkgconfig:$PKG_CONFIG_PATH

再进去hexpand所在目录下进行hexpand的编译

0x05 报错make: clang: Command not found

apt-get install clang

0x06 hexpand的使用方法

在hexpand所在目录（当然你也可以把文件复制到/usr/bin/里）

./hexpand -t md5 -s 21232f297a57a5a743894a0e4a801fc3 -l 5 -m "pcat"

其中-l的5是哈希原文的长度，运行后就会得到附加数据，以及新得到的哈希值。

7. Kali 2018.1等安装错误

-= 2018.08补充 =-

按以上的方法如果在Kali 2018.1或者别的版本上运行报错如下：

hexpand.c:22:27: error: incomplete definition of type 'struct evp_md_ctx_st'
        int length_modulo = mdctx->digest->block_size;
                            ~~~~~^
/usr/include/openssl/ossl_typ.h:92:16: note: forward declaration of 'struct evp_md_ctx_st'
typedef struct evp_md_ctx_st EVP_MD_CTX;
               ^
hexpand.c:32:63: error: incomplete definition of type 'struct evp_md_ctx_st'
        unsigned char* h_data = (unsigned char *)((SHA512_CTX *)mdctx->md_data)->h;

……

这个跟系统有关系，Kali每一次变化都很大。这个得更新到最新的OpenSSL

git clone https://github.com/PeterMosmans/openssl
cd openssl
./config && make && make test && make install

在最后的make install会看到

cp libcrypto.pc /usr/local/ssl/lib/pkgconfig
chmod 644 /usr/local/ssl/lib/pkgconfig/libcrypto.pc
cp libssl.pc /usr/local/ssl/lib/pkgconfig
chmod 644 /usr/local/ssl/lib/pkgconfig/libssl.pc
cp openssl.pc /usr/local/ssl/lib/pkgconfig
chmod 644 /usr/local/ssl/lib/pkgconfig/openssl.pc

把这3个新的pc文件替换到/usr/lib/pkgconfig/下

cd /usr/local/ssl/lib/pkgconfig/ && cp openssl.pc libssl.pc libcrypto.pc /usr/lib/pkgconfig/

（注意，PKG_CONFIG_PATH环境变量要存在，可往上翻看第4点）

再进去hexpand文件夹下编译会报错：

hexpand.c:47:70: error: format specifies type 'unsigned int' but the argument has type '__uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
        if (length_modulo == 128) sprintf(output+2*padding, "%032" PRIx32 , htole64(8*length));
                                                             ~~~~~~         ^~~~~~~~~~~~~~~~~
/usr/include/endian.h:75:22: note: expanded from macro 'htole64'
#  define htole64(x) __uint64_identity (x)
                     ^~~~~~~~~~~~~~~~~~~~~
hexpand.c:48:48: error: format specifies type 'unsigned int' but the argument has type '__uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
        else sprintf(output+2*padding, "%016" PRIx32 ,htole64(8*length));
                                        ~~~~~~        ^~~~~~~~~~~~~~~~~
/usr/include/endian.h:75:22: note: expanded from macro 'htole64'
#  define htole64(x) __uint64_identity (x)
                     ^~~~~~~~~~~~~~~~~~~~~
2 errors generated.
Makefile:21: recipe for target 'hexpand.o' failed

这个就是系统文件的问题了，我查阅了当前的/usr/include/endian.h

# define htole64(x) __uint64_identity (x)

而查阅老系统版本的/usr/include/endian.h

# define htole64(x) (x)

所以这个问题的暂时解决方法，修改下hexpand.c文件

sed -i 's/htole64(8\*length)/(8\*length)/g' hexpand.c

再进行编译，报错：

clang hexpand.o main.o -o hexpand  -L/usr/local/ssl/lib -lssl -lcrypto
/usr/local/ssl/lib/libcrypto.a(dso_dlfcn.o): In function `dlfcn_globallookup':
dso_dlfcn.c:(.text+0x11): undefined reference to `dlopen'
dso_dlfcn.c:(.text+0x24): undefined reference to `dlsym'
dso_dlfcn.c:(.text+0x2f): undefined reference to `dlclose'
/usr/local/ssl/lib/libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_func':
dso_dlfcn.c:(.text+0x374): undefined reference to `dlsym'
dso_dlfcn.c:(.text+0x432): undefined reference to `dlerror'
/usr/local/ssl/lib/libcrypto.a(dso_dlfcn.o): In function `dlfcn_bind_var':
dso_dlfcn.c:(.text+0x4a7): undefined reference to `dlsym'
dso_dlfcn.c:(.text+0x562): undefined reference to `dlerror'
/usr/local/ssl/lib/libcrypto.a(dso_dlfcn.o): In function `dlfcn_load':
dso_dlfcn.c:(.text+0x5c8): undefined reference to `dlopen'
dso_dlfcn.c:(.text+0x62d): undefined reference to `dlclose'
dso_dlfcn.c:(.text+0x665): undefined reference to `dlerror'
/usr/local/ssl/lib/libcrypto.a(dso_dlfcn.o): In function `dlfcn_pathbyaddr':
dso_dlfcn.c:(.text+0x701): undefined reference to `dladdr'
dso_dlfcn.c:(.text+0x75f): undefined reference to `dlerror'
/usr/local/ssl/lib/libcrypto.a(dso_dlfcn.o): In function `dlfcn_unload':
dso_dlfcn.c:(.text+0x7b2): undefined reference to `dlclose'
clang: error: linker command failed with exit code 1 (use -v to see invocation)
Makefile:19: recipe for target 'hexpand' failed

这也是新版OpenSSL的问题，只要加上-ldl -lpthread进行编译即可，编辑Makefile文件

sed -i 's/--libs openssl)/& -ldl -lpthread /g' Makefile

最后就可以顺利编译成功。