KHC(1)

NAME
khc

DESCRIPTION
Known Host Cracker (khc) is a small tool designed to recover hashed known_host files back to their plain-text equivalents.

EXAMPLES
Guess private network addresses for IPv4 khc -f known_host -p > results.out

Guessing just 10.10.10.0 to 10.10.37.0 khc -f known_host -s 10.10.10.0 -e 10.10.37.0 > results.out

Guessing IPv6 is familiar khc -f known_host -s 0000:0000:0000:0000:0000:0000:0000:0000 -e 0000:0000:0000:0000:0000:ffff:ffff:ffff > results.out

Please use ./khc to get the list of options.

CONCEPT
OpenSSH provides the ability to hash the known_host file using salted SHA. Because of how IPv4, IPv6 and host names are created, this tool is able to attack the following vectors:

1.  Limited char-sets

2.  known plain-text

Description related to:

        a) IPv4
            A typical IPv4 address consists of four numbers between 0-255
            separated by a dot. Furthermore no IPv4 address can start with a
            dot and it is very likely that private/reserved IP spaces might
            not be used for hosts at the Internet.
            The complexity is below 2^32
        b) IPv6
            IPv6 is hexadecimal and provides a bigger address size.
            Except this everything works like for IPv4.
        c) Host-names
            Host-names have similar rules for their naming scheme than
            IP addresses. But because the char-set is bigger the complexity
            raises. It is known that OpenSSH converts every host-name
            to lowercase which reduces the complexity a lot.
            Except this it is believed that attacking the known_host file
            via the IPs is the faster and more efficient way.
            OpenSSH stores the host-name AND the IP for a given host-name.
            This might not be true for IPv6 at all but you can, in case you
            guessed a valid IPv6 address and the reverse look-up provides
            you the host-name, brute force host-names based upon that
            information.