Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Splitting binary files for strings does not behave as expected #3223

Open
Sohcahtoa82 opened this issue Aug 15, 2024 · 0 comments
Open

Splitting binary files for strings does not behave as expected #3223

Sohcahtoa82 opened this issue Aug 15, 2024 · 0 comments
Labels

Comments

@Sohcahtoa82
Copy link

TruffleHog Version

3.81.8

Trace Output

https://gist.github.com/Sohcahtoa82/90718ed0aab6ec66ccb891f702cbcb55

Expected Behavior

In the test example given below, the raw result should be:
$6$rounds=656000$TfzXxXnsPbgX0ZnH$S4I6mO0ca8cESdfonaWglmF/zCQUK6hXQsg/hGED999vav3lqLI9/1NV5CSu0sm1BlR0ZiQW6S.vJOigT622z0

Actual Behavior

Raw result is actually:
$6$rounds=656000$TfzXxXnsPbgX0ZnH$S4I6mO0ca8cESdfonaWglmF/zCQUK6hXQsg/hGED999vav3lqLI9/1NV5CSu0sm1BlR0ZiQW6S.vJOigT622z0test3

Despite there being two invalid bytes (0x00 and 0x02) between the secret hash and "test3", the two are treated as a single string with the invalid bytes removed.

Steps to Reproduce

  1. Create the test file with echo -e "\xfftest\$6\$rounds=656000\$TfzXxXnsPbgX0ZnH\$S4I6mO0ca8cESdfonaWglmF/zCQUK6hXQsg/hGED999vav3lqLI9/1NV5CSu0sm1BlR0ZiQW6S.vJOigT622z0\x00test3_test4" > testfile
  2. Create the config.yaml with a regex for SHA512-Crypt hashes:
detectors:
- name: SHA512Crypt
  keywords:
  - "$"
  regex:
    adjective: \$6\$(?:rounds=\d+\$)?[./A-Za-z0-9]{1,16}\$[./A-Za-z0-9]+
  1. Run Trufflehog: trufflehog filesystem testfile --no-update --config=../config.yaml

Environment

Darwin MacBook-Pro.home 23.6.0 Darwin Kernel Version 23.6.0: Mon Jul 29 21:13:04 PDT 2024; root:xnu-10063.141.2~1/RELEASE_ARM64_T6020 arm64

Additional Context

Trufflehog versions up to and including 3.32.0 work as expected. Version 3.32.1 was the first version where this behavior changed. Version diff.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

1 participant