[PEN-TEST] Oracle USER$ password hashes

[Olle Segerdahl <olle () NXS SE>]

Does anyone have a clue as to what "encrytion" method Oracle (7.x, 8.x) uses
to store passwords in the SYS.USER$ table?

Since the hashes are always the same for the same password, it most
definately isn't salted....

An example (the default passwords of SYS and SYSTEM):

change_on_install       = D4C5016086B2DC6A
manager                 = D4DF7931AB130E37


/olle