SecuriTeam - BAK Scanner, PHP based MD5/DES cracker

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Ask the Team
Mailing Lists
Advertising Info
Advisories
About SecuriTeam
Blogs

Brought to you by:

Suppliers of:

SecuriTeam in Your Inbox

New vulnerability?
New tool?
Tell us
(Our PGP key).

CanSecWest 2012

2nd Annual Cyber Security

Hack In Paris

Credit:
The information has been provided by Yanick Bourbeau of Buttslap.

Website Security Scan	Code Vulnerability Test	Network Assessment Tool
Detect hidden vulnerabilities	Exhaustive automated testing	Real-time, continuous security
Get guidance from professionals	of internal or 3rd party code.	scanning for your entire network

Protect your website!
Use an External Vulnerability Scanner!
Nothing to install. First report in 1 hour!
www.beyondsecurity.com/vulnerability-scanner

BACK Scanner is a John the Ripper sort of cracker that allows you to crack MD5/DES (and some other variations) at a rate of 12,000 keys / sec. This is a fast, efficient and multi-platform MD5/DES cracker, written in PHP.

Tool:
####################################################################
#    .................. .......   ...... ............... ...............
#   /            __   /       /  /     /               /               /
#  /            __ -.`       /__/     /____       ____/____       ____/
# /_________________/________________/    /______/        /______/
#
#    ................. ..........      ................. .............
#   /             ___//         /____ /       ___      /        __   /
#  /____             /               /       ___      /        _____/
#  /________________/_______________/_______/  /_____/_______/
#
#
####################################################################
# Another fine buttslap release: BAK Scanner v6.66 by __2 (2001-04-10)
####################################################################
# Un bruteforcer a la JOHN THE RIPPER qui bruteforce un MD5 HASH a environs
# 12 000 cl?s;/secondes, il supporte le bon vieux DES et certaines variantes.
####################################################################
# A JOHN THE RIPPER sort of cracker, you can cast it without leaving traces
# and you can crack MD5/DES and some other variations at a rate of 12 000
# keys / sec (PURE MD5 HASH). Finally, a fast, efficient and
# multi-platform cracker.
####################################################################
# How to run:  (INSTALL PHP) (WINDOWS: www.php4win.de / UNIX: www.php.net)
#
#  USAGE: php butt02.php THEHASH LENGTH_OF_WORD_TO_FOUND
#
####################################################################
# To modify the kind of HASH coding used go to line 83
####################################################################

set_time_limit(0);

print "PHP MD5/DES Bruteforcer v1.0\r\n";
print "------------------------\r\n";

if ($argc!=3) die ("USAGE: php butt02.php MD5_HASH CHARS\r\n\r\n- MD5_HASH : The hash to crack\r\n- CHARS    : presumed length of the password to crack\r\n");

$HASH = $argv[1];
$SIZE = (int) $argv[2];
$start = strtotime ("now");
$start2 = strtotime ("now");
$keyspace = pow(75,$SIZE);
########## GEN first KEY ##################
$key = "";
for ($y=0;$y<$SIZE;$y++)
{
$key = $key . "0";
}
###########################################

print "*** Using SIZE: $SIZE, cracking HASH: $HASH\r\n";
print "*** Presumed KeySpace: ".$keyspace."\r\n\r\n";

for ($x=0;$x<$keyspace;$x++)
{
########## GEN NEW KEY ##################
for ($y=0;$y<$SIZE;$y++)
{
if ($key[$y] != "z")
  {
    $key[$y] = chr(ord($key[$y])+1);
    #$key = md5($key);
    if ($y > 0)
    {
    for ($z = 0; $z < $y; $z++) $key[$z] = "0";

    }

    break;



  }
}
#########################################

$key2 = md5($key); # using pure md5
#$key2 = crypt($key); # using DES (classic one)

##### SEE http://www.php.net/crypt to modify the line and add SALTS


if ($HASH==$key2) die ("\r\n!!! Found MATCHING WORD: $key !!! \r\nTook ".date("H:i:s",mktime(0,0,strtotime("now")-$start2))."\r\n");

if ($x % 24000 == 0)
{
  $x2++;
if ($x2 == 4)
{
  $x2 =0;
$time = strtotime ("now") - $start;
$start = strtotime("now");
if ($time==0) $time=1;
$rate = (24000 *4) / $time;
  print "... $x/$keyspace ($key) [$rate Keys/sec]\r\n";
}
}
}

print "NO MATCHS FOUND :( (SIZE is not correct?)\r\nTook ".date("H:i:s",mktime(0,0,strtotime("now")-$start2))."\r\n";

blog comments powered by Disqus

	Apache mod_rewrite Vulnerability PoC
	netsniff-ng - A Linux Network Analyzer and Networking Toolkit
	Simple Local File Inclusion Exploiter
	NiX A Linux Brute Forcer
	Nchop - A TCP Session Splicing Tool Used to Rvade Intrusion Detection Systems
	Netifera - Modular Open Source Platform for Security Tools
	WarVOX - Tools for Exploring, Classifying, and Auditing Telephone Systems
	Webshag - Web Server Audit Tool
	Browser Fuzzer
	FSpy - Linux Filesystem Activity Monitoring
	telnetrecon - Telnet Recon
	Zerowine Sandbox
	JPEG Fuzzer
	VNC Server Fuzzer
	RSH Fuzzer