[20191127]表 full Hash Value的计算.txt

519 0 0

作者:lfree

[20191127]表 full Hash Value的计算.txt

--//曾经做过表full Hash Value的计算,当时我是通过建立简单的schema以及表名的形式,使用hashcat破解oracle的
--//表 full Hash Value的计算,参考链接:

http://blog.itpub.net/267265/viewspace-2149366/ => [20171227]表的FULL_HASH_VALUE值的计算
http://blog.itpub.net/267265/viewspace-2214232/ => [20180914]oracle 12c 表 full_hash_value如何计算.txt

--//得到的结论是:
--//表的FULL_HASH_VALUE计算就是table_name.owner加上"1".
--//12c引入了PDB,表的full_hash_value是table_name.owner.con_name1的md5sum值.

--//昨天看了一篇博客,链接https://mvelikikh.blogspot.com/2019/07/vdbpipes-unveiling-truth-of-oracle-hash.html
--//作者通过DebugTrace获得oracle内部函数,主要通过kggmd5Update,确定里面参与运算的字符.
--//我仅仅重复作者的测试验证这个过程:

1.环境:
SYS@book> @ ver1
PORT_STRING                    VERSION        BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx            11.2.0.4.0     Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production

2. 定位相关内部函数:

$ gdb $(which oracle )
GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-45.el5)
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle...(no debugging symbols found)...done.

(gdb) disassemble kglComputeHash
...
0x00000000098445d8 <kglComputeHash+96>: movl   $0xefcdab89,0x4(%r9)
0x00000000098445e0 <kglComputeHash+104>:        mov    -0x48(%rbp),%r10
0x00000000098445e4 <kglComputeHash+108>:        movl   $0x98badcfe,0x8(%r10)
0x00000000098445ec <kglComputeHash+116>:        mov    -0x48(%rbp),%r11
0x00000000098445f0 <kglComputeHash+120>:        movl   $0x10325476,0xc(%r11)
0x00000000098445f8 <kglComputeHash+128>:        mov    0x10(%r15),%rsi
0x00000000098445fc <kglComputeHash+132>:        mov    (%r15),%edx
0x00000000098445ff <kglComputeHash+135>:        callq 0x97f09a4 <kggmd5Update>
0x0000000009844604 <kglComputeHash+140>:        movzbl 0x8(%r15),%eax
0x0000000009844609 <kglComputeHash+145>:        test   %eax,%eax
0x000000000984460b <kglComputeHash+147>:        je     0x984463a <kglComputeHash+194>
0x000000000984460d <kglComputeHash+149>:        lea    -0x90(%rbp),%rdi
0x0000000009844614 <kglComputeHash+156>:        lea    0x6359d1(%rip),%rsi        # 0x9e79fec <_2__STRING.98.0>
0x000000000984461b <kglComputeHash+163>:        mov    $0x1,%edx
0x0000000009844620 <kglComputeHash+168>:        callq 0x97f09a4 <kggmd5Update>
...
--//你可以发现多处kggmd5Update的调用.

3.建立gdb脚本:
$ cat md5.gdb
set pagination off

break kggmd5Update
commands
    printf "Length: %dn",$rdx
    x/8xc $rsi
    c
end

break kglComputeHash
commands
    c
end

break kggmd5Process
commands
    c
end

break kggmd5Finish
commands
    c
end

--//session 1:
SCOTT@book> @ spid
       SID    SERIAL# PROCESS                  SERVER    SPID       PID P_SERIAL# C50
---------- ---------- ------------------------ --------- ------ ------- ---------- --------------------------------------------------
        75        751 21617                    DEDICATED 21618       29        156 alter system kill session '75,751' immediate;

--//session 2:
$ gdb -p 21618 -x md5.gdb
...
Breakpoint 1 at 0x97f09a8
Breakpoint 2 at 0x984457c
Breakpoint 3 at 0x97f14be
Breakpoint 4 at 0x97f0830

--//session 1:
SCOTT@book> desc emp
Name     Null?    Type
-------- -------- ------------
EMPNO    NOT NULL NUMBER(4)
ENAME             VARCHAR2(10)
JOB               VARCHAR2(9)
MGR               NUMBER(4)
HIREDATE          DATE
SAL               NUMBER(7,2)
COMM              NUMBER(7,2)
DEPTNO            NUMBER(2)

--//session 2,按c继续:
Breakpoint 2, 0x000000000984457c in kglComputeHash ()

Breakpoint 1, 0x00000000097f09a8 in kggmd5Update ()
Length: 3
0x7faa77e1fca8: 69 'E' 77 'M' 80 'P' 0 '00'        0 '00'        0 '00'        0 '00'        0 '00'
--//length=3,EMP对应表

Breakpoint 1, 0x00000000097f09a8 in kggmd5Update ()
Length: 1
0x9e79fec <_2__STRING.98.0>:    46 '.' 0 '00'        0 '00'        0 '00'        107 'k' 116 't' 99 'c' 110 'n'
--//length=1 ,小数点.

Breakpoint 1, 0x00000000097f09a8 in kggmd5Update ()
Length: 5
0x863db2f4:     83 'S' 67 'C' 79 'O' 84 'T' 84 'T' 0 '00'        0 '00'        0 '00'
--//length=5 ,SCOTT就是owner.

Breakpoint 1, 0x00000000097f09a8 in kggmd5Update ()
Length: 4
0x7fffbb155800: 1 '01'        0 '00'        0 '00'        0 '00'        -1 '' 127 '177'      0 '00'        0 '00'
--//length=4 ,字符'01000000'

Breakpoint 4, 0x00000000097f0830 in kggmd5Finish ()

Breakpoint 1, 0x00000000097f09a8 in kggmd5Update ()
Length: 43
0xbefbe20 <kggmd5padding.0>:    -128 '200'     0 '00'        0 '00'        0 '00'        0 '00'        0 '00'        0 '00'        0 '00'

Breakpoint 1, 0x00000000097f09a8 in kggmd5Update ()
Length: 8
0x7fffbb155750: 104 'h' 0 '00'        0 '00'        0 '00'        0 '00'        0 '00'        0 '00'        0 '00'

--//这些字符拼接起来就是EMP.SCOTT01000000,也就是表md5按照此内容计算.

SYS@book> select dbms_crypto.hash(rawtohex('EMP.SCOTT'||chr(1)||chr(0)||chr(0)||chr(0)), 2) c40 from dual;
C40
----------------------------------------
1EA14E682B60AB3ED11D8E77D1E781E2

--//1EA14E682B60AB3ED11D8E77D1E781E 按照4位反转就是 684ea11e 3eab602b 778e1dd1 0081e7d1
--//验证看看:

SYS@book> select owner,name,namespace,type,hash_value,full_hash_value from V$DB_OBJECT_CACHE where owner='SCOTT' and name='EMP';
OWNER NAME NAMESPACE       TYPE HASH_VALUE FULL_HASH_VALUE
------ ---- --------------- ----- ---------- --------------------------------
SCOTT EMP TABLE/PROCEDURE TABLE 3800164305 684ea11e3eab602b778e1dd1e281e7d1

--//对比反转后结果完全能对上.后面的chr(1)||chr(0)||chr(0)||chr(0)实际上与namespace有关.可以执行如下确定:
--//select distinct kglhdnsp,kglhdnsd,kglobtyd from x$kglob order by 1;

--//使用操作系统命令计算如下:

$ echo -e -n 'EMP.SCOTT1' | md5sum | sed 's/ -//' | xxd -r -p | od -t x4 | sed -n -e 's/^0000000 //' -e 's/ //gp'
684ea11e3eab602b778e1dd1e281e7d1

--//可以发现完成能对上.