Cyber security

GUIDTool – Mastering Analysis And Prediction Of Version 1 UUIDs

A simple tool to analyse version 1 GUIDs/UUIDs from a system. With the information obtained from analysis, it is often possible to forge future v1 GUIDs created by the system, if you know the approximate time they were created.

Installation

Clone the repository, cd into it and run:

pip install .

pipx can be used in place of pip.

Once installed, you should be able to run guidtool -h to see the help text.

Usage

Inspecting GUIDs

Version 1 GUIDs can be inspected with guidtool -i <guid>:

$ guidtool -i 95f6e264-bb00-11ec-8833-00155d01ef00
UUID version: 1
UUID time: 2022-04-13 08:06:13.202186
UUID timestamp: 138691299732021860
UUID node: 91754721024
UUID MAC address: 00:15:5d:01:ef:00
UUID clock sequence: 2099

Creating GUIDs

If you have a sample GUID from a system, and know the approximate time a target GUID you wish to guess was created, you can generate a list of potential GUIDs to try guess by supplying the approximate GUID creation time to -t:

$ guidtool -t '2022-04-13 09:12:54' 95f6e264-bb00-11ec-8833-00155d01ef00 | head
e6079880-bb09-11ec-8833-00155d01ef00
e607bf90-bb09-11ec-8833-00155d01ef00
e607e6a0-bb09-11ec-8833-00155d01ef00
e6080db0-bb09-11ec-8833-00155d01ef00
e60834c0-bb09-11ec-8833-00155d01ef00
e6085bd0-bb09-11ec-8833-00155d01ef00
...

By default this assumes that:

  • The time encoded in the GUID is only precise to the nearest millisecond (10,000 100-nanosecond intervals). You can change this by specifying the number of 100-nanonsecond intervals between each GUID generated by the target with -p.
    • To determine the correct number here, obtain a few GUIDs from the system, check the number of 0s at the end of their timestamps with guidtool -i, and then use a 1 followed by that number of 0s as the argument to -p.
    • The estimated GUID creation time is within 1 second of the real GUID creation time. You can create GUIDs for a wider range of times using -r, e.g. if you are only within 3 seconds then supplying -r 3 will generate GUIDs starting 3 seconds before and ending 3 seconds after the time given in -t.
Tamil S

Tamil has a great interest in the fields of Cyber Security, OSINT, and CTF projects. Currently, he is deeply involved in researching and publishing various security tools with Kali Linux Tutorials, which is quite fascinating.

Recent Posts

ExecutePeFromPngViaLNK – Advanced Execution Of Embedded PE Files via PNG And LNK

Extract and execute a PE embedded within a PNG file using an LNK file. The…

3 days ago

Red Team Certification – A Comprehensive Guide To Advancing In Cybersecurity Operations

Embark on the journey of becoming a certified Red Team professional with our definitive guide.…

4 days ago

CVE-2024-5836 / CVE-2024-6778 : Chromium Sandbox Escape via Extension Exploits

This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within…

1 week ago

Rust BOFs – Unlocking New Potentials In Cobalt Strike

This took me like 4 days (+2 days for an update), but I got it…

1 week ago

MaLDAPtive – Pioneering LDAP SearchFilter Parsing And Security Framework

MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection. Its foundation is…

1 week ago

Cloudkicker – Implementing Basic Authentication ith .htaccess And htpasswd

There are a number of excellent tutorials. I recommend this one: Basically, you are going…

1 week ago