ansiblevault

Documentation

Overview

Package ansiblevault triages an Ansible Vault file for password cracking.

Ansible Vault (`$ANSIBLE_VAULT;…`) is the standard at-rest encryption for secrets in Ansible playbooks/roles — ubiquitous in DevOps and infrastructure-as-code repositories, and so a common loot artifact on a CI/ops host or in a pulled repo. The vault password is the single secret protecting every value inside, and it is a slow PBKDF2-HMAC-SHA256 target: this parses the header offline and reports the version, cipher, optional vault-id, and the matching hashcat mode (16900) so the result feeds straight into the project's hash/cracking tooling.

No confidently-wrong output: the file is recognised only by its `$ANSIBLE_VAULT;` magic header; it reports the *envelope parameters* only — it does not crack or decrypt (the password is never recovered); and a non-vault input is rejected. When the body is a well-formed AES256 envelope it also rebuilds the ready-to-crack ansible2john hash (`$ansible$0*0*…`, hashcat mode 16900) offline — the body is hexlify(hexlify(salt)+"\n"+hmac+"\n"+hexlify(ct)), so a single hex-decode yields the three fields verbatim. The rebuild is structurally guarded (32-byte salt + 32-byte HMAC, valid-hex ciphertext): on any deviation it emits no hash rather than a wrong one.

Wrap-vs-native: native — a header parse + an offline ansible2john rebuild over the documented format (ansible lib/ansible/parsing/vault/__init__.py); stdlib only, no new go.mod dependency. Anchored to real ansible-vault output.

Index

• type Result
  • func Decode(input string) (*Result, error)

Types

type Result

type Result struct {
	Format  string `json:"format"`
	Version string `json:"version"`
	Cipher  string `json:"cipher"`
	// VaultID is the label from a 1.2 header (e.g. "prod"), empty for 1.1.
	VaultID string `json:"vault_id,omitempty"`
	// BodyBytes is the size of the hex-decoded vault envelope (salt + HMAC +
	// ciphertext), 0 if the body is absent or not valid hex.
	BodyBytes int `json:"body_bytes"`

	// JohnHash is the ready-to-crack ansible2john / hashcat-16900 string
	// ("$ansible$0*0*salt*hmac*ciphertext"), rebuilt offline from the body when
	// it is a well-formed AES256 envelope; empty when the body is absent or its
	// structure does not match (no confidently-wrong output).
	JohnHash string `json:"john_hash,omitempty"`

	HashcatMode int    `json:"hashcat_mode"`
	JohnTool    string `json:"john_tool"`
	Note        string `json:"note"`
}

Result is the decoded Ansible Vault envelope.

func Decode

func Decode(input string) (*Result, error)

Decode parses an Ansible Vault file's header.