Ettercap/ettercap — pull request #370 by kholia (2013-10-24 05:12:16+00:00)
Title: add support for parsing RIPv2 MD5 authentication packets

Sample .pcap file(s) can be download from https://github.com/kholia/my-pcaps URL.

```
$ ./src/ettercap -Tqr ~/RIPv2\ MD5\ authentication\ \[PROPER\].pcap | sort | uniq
...
RIPv2-224.0.0.9-520:$netmd5$02020000ffff0003002c01145267d48d000000000000000000020000ac100100ffffff000000000000000001ffff0001$1e372a8a233c6556253a0909bc3dcce6
RIPv2-224.0.0.9-520:$netmd5$02020000ffff0003002c01145267d48f000000000000000000020000ac100100ffffff000000000000000001ffff0001$ed9f940c3276afcc06d15babe8a1b61b
RIPv2-224.0.0.9-520:$netmd5$02020000ffff0003002c01145267d490000000000000000000020000ac100100ffffff000000000000000001ffff0001$c9f7763f80fcfcc2bbbca073be1f5df7
RIPv2-224.0.0.9-520:$netmd5$02020000ffff0003002c01145267d49a000000000000000000020000ac100200ffffff000000000000000001ffff0001$3f6a72deeda200806230298af0797997
RIPv2-224.0.0.9-520:$netmd5$02020000ffff0003002c01145267d49b000000000000000000020000ac100200ffffff000000000000000001ffff0001$b69184bacccc752cadf78cac455bd0de
RIPv2-224.0.0.9-520:$netmd5$02020000ffff0003002c01145267d49d000000000000000000020000ac100100ffffff000000000000000001ffff0001$6442669c577e7662188865a54c105d0e
```

Cracking the hashes with JtR (bleeding-jumbo).

```
$ ../run/john hashes 1 ↵
Loaded 6 password hashes with 6 different salts (net-md5, "Keyed MD5" RIPv2, OSPF, BGP, SNMPv2 [MD5 32/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
quagga (RIPv2-224.0.0.9-520)
quagga (RIPv2-224.0.0.9-520)
quagga (RIPv2-224.0.0.9-520)
quagga (RIPv2-224.0.0.9-520)
quagga (RIPv2-224.0.0.9-520)
quagga (RIPv2-224.0.0.9-520)
```