Hash Collisions

Commands

$ xxd -r -p file.hex > file.bin

• convert hex string into binary file xxd -p file
• hex dump of file $ openssl dgst [-md5 / -sha256 / etc.] file1.bin file2.bin
• compute hash of binary file(s) $ fastcoll -o file1 file2
• (not a native command) generates two binary files with the same hash $ fastcoll -p prefix -o col1 col2
• generate two files with same MD5 hash, both starting with the same prefix $ cat col1 suffix > file1.py; cat col2 suffix > file2.py
• append suffix to two collision files —> due to length extension, they will have the same hash

Exploit

$ fastcoll -p prefix -o col1 col2

• result:
  • col1: prefix || blob_a
  • col2: prefix || blob_b $ cat col1 suffix > file1.py; cat col2 suffix > file2.py
• result:
  • file1.py: prefix || blob_a || suffix
  • file2.py: prefix || blob_b || suffix

graph LR
	A["col1: prefix"] --> C[["fastcoll"]]
	B["col2: prefix"] --> C
	C --> D["col1: prefix || blob_a"]
	C --> E["col2: prefix || blob_b"]
	D --> F["suffix"]
	E --> F
	F --> G["col1: prefix || blob_a || suffix"]
	F --> H["col2: prefix || blob_b || suffix"]
	G --> I["file1.py"]
	H --> J["file2.py"]

• at every step, col1 and col2 have the same MD5 hash, but differ in their SHA-256 hashes
• we can use this to generate two files, file1.py and file2.py, that appear the same to any MD5 verifiers but execute different (malicious) code