1  
   2  #!/usr/bin/php
   3  <?php
   4  /* $Id: dicattack.php 30 2007-07-13 23:03:03Z zapotek $ */
   5  /********************************************************************
   6   * Author Info
   7   * -----------
   8   * Author:       Zapotek
   9   * E-Mail:       zapotek@segfault.gr
  10   * Website:      http://www.segfault.gr
  11   *
  12   * File Info
  13   * ---------
  14   * Name:         DicAttack
  15   *
  16   * Comments
  17   * --------
  18   * DicAttack is a wordlist (dictionary) attacker.
  19   * It takes each word in the file and compares
  20   * it against the given hash.
  21   * Currently supported algorithms are MD5 and SHA1.
  22   ********************************************************************/
  23  
  24  define( 'VERSION', 0.2 );
  25  
  26  $supported = "MD5/SHA1";
  27  $name      = array_shift( $argv );
  28  $wordlist  = array_shift( $argv );
  29  $hash      = array_shift( $argv );
  30  
  31  // print te banner
  32  banner( );
  33  
  34  // in case of inadequate input exit
  35  if( $argc != 3 ) {
  36      echo "Syntax: $name <wordlist file> <hash>\n\n";
  37      exit( );
  38  }
  39  
  40  if( !file_exists( $wordlist ) ){
  41      echo "Can't access wordlist file: $wordlist'\n";
  42      exit( );
  43  }
  44  
  45  // start the timer
  46  $time_start = getmicrotime( );
  47     
  48  // get the encryption algorithm
  49  switch( strlen( $hash ) ) {
  50  
  51      // if the hash is 32 chars long it's a MD5 Hash
  52      case 32;
  53          echo "\nGuessing MD5...\n\n";
  54          $string = crack( $wordlist, "md5", $hash );
  55          break;
  56  
  57      // if the hash is 40 chars long it's a SHA1 hash
  58      case 40;
  59          echo "\nGuessing SHA1...\n\n";
  60          $string = crack( $wordlist, "sha1", $hash );
  61          break;
  62  
  63      // else print error msg
  64      default;
  65          echo "Could not determine the encryption algorithm.\n";
  66          echo "Ensure that the hash is correct and try again.\n";
  67          exit( );
  68  }
  69  
  70  if( $string ){
  71      // stop the timer, we've got a winner!
  72      $time_stop = getmicrotime( );
  73      echo "Crack Successful!\n"."-----------------\n";
  74      echo "$hash = $string\n"."-----------------\n";
  75      $time = $time_stop - $time_start;
  76      echo "[ Operation took $time seconds ]\n\n";
  77  } else {
  78      echo "Could not find mach in $wordlist, maybe you should try" .
  79           " a bigger wordlist file.\n";
  80  }
  81  
  82  // our litle banner
  83  function banner( ) {
  84      global $supported, $name;
  85      echo "\nDicAttack v". VERSION .
  86           "\nSimple wordlist based password cracker\n" .
  87           "by Zapotek <zapotek [at] segfault.gr>\n" .
  88           "<http://www.segfault.gr>\n\n" .
  89           "Currently supported algorithms: $supported\n\n";
  90           
  91  }
  92  
  93  //Our little timer function
  94  function getmicrotime( ) {
  95      list ( $usec, $sec ) = explode( " ", microtime( ) );
  96      return ( (float) $usec + (float) $sec );
  97  }
  98  
  99  /**
 100   * disctionary attack function
 101   *
 102   * @param   string  wordlist file, words must be seperated by newlines
 103   * @param   string  the algorithm of the hash (md5 or sha1)
 104   * @param   string  the md5 or sha1 hash to crack
 105   *
 106   * @return  string  the cracked string or 0
 107   */
 108  function crack( $wordlist_file, $algo, $hash ) {
 109         
 110      $words = file( $wordlist_file );
 111     
 112      foreach( $words as $word) {
 113          switch( strtolower( $algo ) ) {
 114  
 115              case "md5";
 116                  $word_hash = md5( $word );
 117                  break;
 118  
 119              case "sha1";
 120                  $word_hash = sha1( $word );
 121                  break;
 122          }
 123  
 124          if( $word_hash == $hash ) {
 125              return $word;
 126          }
 127      }
 128  }
 129  
 130  ?>
 131  
 132