')[1][:-3]
- else:
- return None
-
-
-class DIGITALSUN:
- name = "digitalsun.pl"
- url = "http://md5.digitalsun.pl"
- supported_algorithm = [MD5]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://md5.digitalsun.pl/"
-
- # Build the parameters
- params = {"hash": hashvalue}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'[^<]* == [^<]*
\s*
', html)
-
- if match:
- return match.group().split('b>')[1][:-2]
- else:
- return None
-
-
-class MYINFOSEC:
- name = "myinfosec"
- url = "http://md5.myinfosec.net"
- supported_algorithm = [MD5]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://md5.myinfosec.net/md5.php"
-
- # Build the parameters
- params = {"md5hash": hashvalue}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'[^<]*[^<]*
', html)
-
- if match:
- return match.group().split('>')[3][:-6]
- else:
- return None
-
-
-class MD5_NET:
- name = "md5.net"
- url = "http://md5.net"
- supported_algorithm = [MD5]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://www.md5.net/cracker.php"
-
- # Build the parameters
- params = {"hash": hashvalue}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'', html)
-
- if match:
- return match.group().split('"')[7]
- else:
- return None
-
-
-class NOISETTE:
- name = "noisette.ch"
- url = "http://md5.noisette.ch"
- supported_algorithm = [MD5]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://md5.noisette.ch/index.php"
-
- # Build the parameters
- params = {"hash": hashvalue}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'String to hash : ', html)
-
- if match:
- return match.group().split('"')[3]
- else:
- return None
-
-
-class MD5HOOD:
- name = "md5hood"
- url = "http://md5hood.com"
- supported_algorithm = [MD5]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://md5hood.com/index.php/cracker/crack"
-
- # Build the parameters
- params = {"md5": hashvalue,
- "submit": "Go"}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'
[^<]*
', html)
-
- if match:
- return match.group().split('>')[1][:-5]
- else:
- return None
-
-
-class XANADREL:
- name = "99k.org"
- url = "http://xanadrel.99k.org"
- supported_algorithm = [MD4, MD5]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://xanadrel.99k.org/hashes/index.php?k=search"
-
- # Build the parameters
- params = {"hash": hashvalue,
- "search": "ok"}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'Hash : [^<]*
Type : [^<]*
Plain : "[^"]*"
', html)
-
- if match:
- return match.group().split('"')[1]
- else:
- return None
-
-
-class SANS:
- name = "sans"
- url = "http://isc.sans.edu"
- supported_algorithm = [MD5, SHA1]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://isc.sans.edu/tools/reversehash.html"
-
- # Build the Headers with a random User-Agent
- headers = {"User-Agent": USER_AGENTS[randint(0, len(USER_AGENTS)) - 1]}
-
- # Build the parameters
- response = do_HTTP_request(url, httpheaders=headers)
- html = None
- if response:
- html = response.read()
- else:
- return None
- match = search(r'', html)
- token = ""
- if match:
- token = match.group().split('"')[5]
- else:
- return None
-
- params = {"token": token,
- "text": hashvalue,
- "word": "",
- "submit": "Submit"}
-
- # Build the Headers with the Referer header
- headers["Referer"] = "http://isc.sans.edu/tools/reversehash.html"
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params, headers)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'... hash [^\s]* = [^\s]*\s*
', html)
-
- if match:
- print "hola mundo"
- return match.group().split('=')[1][:-10].strip()
- else:
- return None
-
-
-class BOKEHMAN:
- name = "bokehman"
- url = "http://bokehman.com"
- supported_algorithm = [MD4, MD5]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- # 创建查询URL
- url = "http://bokehman.com/cracker/"
-
- # Build the parameters from the main page
- response = do_HTTP_request(url)
- html = None
- if response:
- html = response.read()
- else:
- return None
- match = search(r'', html)
- phpsessnid = ""
- if match:
- phpsessnid = match.group().split('"')[7]
- else:
- return None
- match = search(r'', html)
- key = ""
- if match:
- key = match.group().split('"')[7]
- else:
- return None
-
- params = {"md5": hashvalue,
- "PHPSESSID": phpsessnid,
- "key": key,
- "crack": "Try to crack it"}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'| [^<]* | [^<]* | [^s]*seconds |
', html)
-
- if match:
- return match.group().split('td>')[1][:-2]
- else:
- return None
-
-
-class GOOG_LI:
- name = "goog.li"
- url = "http://goog.li"
- supported_algorithm = [MD5, MYSQL, SHA1, SHA224, SHA384, SHA256, SHA512, RIPEMD, NTLM, GOST, WHIRLPOOL, LDAP_MD5,
- LDAP_SHA1]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- hash2 = None
- if alg in [NTLM] and ':' in hashvalue:
- hash2 = hashvalue.split(':')[1]
- else:
- hash2 = hashvalue
-
- # Confirm the initial '*' character
- if alg == MYSQL and hash2[0] != '*':
- hash2 = '*' + hash2
-
- # 创建查询URL
- url = "http://goog.li/?q=%s" % (hash2)
-
- # 进行http 网络查询
- response = do_HTTP_request(url)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'
cleartext[^:]*: [^<]*
', html)
-
- if match:
- return match.group().split(':')[1].strip()[:-6]
- else:
- return None
-
-
-class WHREPORITORY:
- name = "Windows Hashes Repository"
- url = "http://nediam.com.mx"
- supported_algorithm = [LM, NTLM]
-
- def isSupported(self, alg):
- """Return True if HASHCRACK can crack this type of algorithm and
- False if it cannot."""
-
- if alg in self.supported_algorithm:
- return True
- else:
- return False
-
- def crack(self, hashvalue, alg):
- """Try to crack the hash.
- @param hashvalue Hash to crack.
- @param alg Algorithm to crack."""
-
- # 检查是否支持该种算法
- if not self.isSupported(alg):
- return None
-
- hash2 = None
- if ':' in hashvalue:
- if alg == LM:
- hash2 = hashvalue.split(':')[0]
- else:
- hash2 = hashvalue.split(':')[1]
- else:
- hash2 = hashvalue
-
- # 创建查询URL, parameters and headers
- url = ""
- params = None
- headers = None
- if alg == LM:
- url = "http://nediam.com.mx/winhashes/search_lm_hash.php"
- params = {"lm": hash2,
- "btn_go": "Search"}
- headers = {"Referer": "http://nediam.com.mx/winhashes/search_lm_hash.php"}
- else:
- url = "http://nediam.com.mx/winhashes/search_nt_hash.php"
- params = {"nt": hash2,
- "btn_go": "Search"}
- headers = {"Referer": "http://nediam.com.mx/winhashes/search_nt_hash.php"}
-
- # 进行http 网络查询
- response = do_HTTP_request(url, params, headers)
-
- # 分析响应
- html = None
- if response:
- html = response.read()
- else:
- return None
-
- match = search(r'| PASSWORD | [^<]* |
', html)
-
- if match:
- return match.group().split(':')[1]
- else:
- return None
-
-
-CRAKERS = [
- NETMD5CRACK,
- BENRAMSEY,
- GROMWEB,
- HASHCRACKING,
- VICTOROV,
- THEKAINE,
- TMTO,
- REDNOIZE,
- MD5_DB,
- MY_ADDR,
- MD5PASS,
- MD5DECRYPTION,
- MD5CRACK,
- MD5_DECRYPTER,
- AUTHSECUMD5,
- HASHCRACK,
- OPHCRACK,
- C0LLISION,
- CMD5,
- AUTHSECUCISCO7,
- CACIN,
- IBEAST,
- PASSWORD_DECRYPT,
- HASHCHECKER,
- MD5HASHCRACKER,
- PASSCRACKING,
- ASKCHECK,
- FOX21,
- NICENAMECREW,
- JOOMLAAA,
- MD5_LOOKUP,
- SHA1_LOOKUP,
- SHA256_LOOKUP,
- RIPEMD160_LOOKUP,
- MD5_COM_CN,
- DIGITALSUN,
- MYINFOSEC,
- MD5_NET,
- NOISETTE,
- MD5HOOD,
- XANADREL,
- SANS,
- BOKEHMAN,
- GOOG_LI,
- WHREPORITORY ]
-
-
-
-########################################################################################################
-### GENERAL METHODS
-########################################################################################################
-
-def configureCookieProcessor (cookiefile='/tmp/searchmyhash.cookie'):
- '''Set a Cookie Handler to accept cookies from the different Web sites.
-
- @param cookiefile Path of the cookie store.'''
-
- cookieHandler = LWPCookieJar()
- if cookieHandler is not None:
- if path.isfile (cookiefile):
- cookieHandler.load (cookiefile)
-
- opener = urllib2.build_opener ( urllib2.HTTPCookieProcessor(cookieHandler) )
- urllib2.install_opener (opener)
-
-
-
-def do_HTTP_request (url, params={}, httpheaders={}):
- '''
- Send a GET or POST HTTP Request.
- @return: HTTP Response
- '''
-
- data = {}
- request = None
-
- # If there is parameters, they are been encoded
- if params:
- data = urlencode(params)
-
- request = urllib2.Request ( url, data, headers=httpheaders )
- else:
- request = urllib2.Request ( url, headers=httpheaders )
-
- # Send the request
- try:
- response = urllib2.urlopen (request)
- except:
- return ""
-
- return response
-
-
-def printSyntax ():
- """Print application syntax."""
-
- print """%s 0.1 ( https://github.com/ym2011/penetration )
-
-Usage:
-------
-
- python %s <加密算法> 选项
-
-
-目前支持的算法是:
---------------------------------------------
-
- MD4 - RFC 1320
- MD5 - RFC 1321
- SHA1 - RFC 3174 (FIPS 180-3)
- SHA224 - RFC 3874 (FIPS 180-3)
- SHA256 - FIPS 180-3
- SHA384 - FIPS 180-3
- SHA512 - FIPS 180-3
- RMD160 - RFC 2857
- GOST - RFC 5831
- WHIRLPOOL - ISO/IEC 10118-3:2004
- LM - Microsoft Windows hash
- NTLM - Microsoft Windows hash
- MYSQL - MySQL 3, 4, 5 hash
- CISCO7 - Cisco IOS type 7 encrypted passwords
- JUNIPER - Juniper Networks $9$ encrypted passwords
- LDAP_MD5 - MD5 Base64 encoded
- LDAP_SHA1 - SHA1 Base64 encoded
-
- NOTE: for LM / NTLM it is recommended to introduce both values with this format:
- python %s LM -h 9a5760252b7455deaad3b435b51404ee:0d7f1f2bdeac6e574d6e18ca85fb58a7
- python %s NTLM -h 9a5760252b7455deaad3b435b51404ee:0d7f1f2bdeac6e574d6e18ca85fb58a7
-
-
-Valid OPTIONS are:
-------------------
-
- -h If you only want to crack one hash, specify its value with this option.
-
- -f If you have several hashes, you can specify a file with one hash per line.
- NOTE: All of them have to be the same type.
-
- -g If your hash cannot be cracked, search it in Google and show all the results.
- NOTE: This option ONLY works with -h (one hash input) option.
-
-
-Examples:
----------
-
- -> Try to crack only one hash.
- python %s MD5 -h 098f6bcd4621d373cade4e832627b4f6
-
- -> Try to crack a JUNIPER encrypted password escaping special characters.
- python %s JUNIPER -h "\$9\$LbHX-wg4Z"
-
- -> If the hash cannot be cracked, it will be searched in Google.
- python %s LDAP_SHA1 -h "{SHA}cRDtpNCeBiql5KOQsKVyrA0sAiA=" -g
-
- -> Try to crack multiple hashes using a file (one hash per line).
- python %s MYSQL -f mysqlhashesfile.txt
-
-
-source:
------------------------------------
-https://github.com/ym2011/penetration
-
-""" % ( (sys.argv[0],) * 8 )
-
-
-
-def crackHash (algorithm, hashvalue=None, hashfile=None):
- """Crack a hash or all the hashes of a file.
-
- @param alg Algorithm of the hash (MD5, SHA1...).
- @param hashvalue Hash value to be cracked.
- @param hashfile Path of the hash file.
- @return If the hash has been cracked or not."""
-
- global CRAKERS
-
- # Cracked hashes will be stored here
- crackedhashes = []
-
- # Is the hash cracked?
- cracked = False
-
- # Only one of the two possible inputs can be setted.
- if (not hashvalue and not hashfile) or (hashvalue and hashfile):
- return False
-
- # hashestocrack depends on the input value
- hashestocrack = None
- if hashvalue:
- hashestocrack = [ hashvalue ]
- else:
- try:
- hashestocrack = open (hashfile, "r")
- except:
- print "\nIt is not possible to read input file (%s)\n" % (hashfile)
- return cracked
-
-
- # Try to crack all the hashes...
- for activehash in hashestocrack:
- hashresults = []
-
- # Standarize the hash
- activehash = activehash.strip()
- if algorithm not in [JUNIPER, LDAP_MD5, LDAP_SHA1]:
- activehash = activehash.lower()
-
- # Initial message
- print "\nCracking hash: %s\n" % (activehash)
-
- # Each loop starts for a different start point to try to avoid IP filtered
- begin = randint(0, len(CRAKERS ) -1)
-
- for i in range(len(CRAKERS)):
-
- # Select the cracker
- cr = CRAKERS[ ( i +begin ) %len(CRAKERS) ]()
-
- # Check if the cracker support the algorithm
- if not cr.isSupported ( algorithm ):
- continue
-
- # Analyze the hash
- print "Analyzing with %s (%s)..." % (cr.name, cr.url)
-
- # Crack the hash
- result = None
- try:
- result = cr.crack ( activehash, algorithm )
- # If it was some trouble, exit
- except:
- print "\nSomething was wrong. Please, contact with us to report the bug:\n\nbloglaxmarcaellugar@gmail.com\n"
- if hashfile:
- try:
- hashestocrack.close()
- except:
- pass
- return False
-
- # If there is any result...
- cracked = 0
- if result:
-
- # If it is a hashlib supported algorithm...
- if algorithm in [MD4, MD5, SHA1, SHA224, SHA384, SHA256, SHA512, RIPEMD]:
- # Hash value is calculated to compare with cracker result
- h = hashlib.new (algorithm)
- h.update (result)
-
- # If the calculated hash is the same to cracker result, the result is correct (finish!)
- if h.hexdigest() == activehash:
- hashresults.append (result)
- cracked = 2
-
- # If it is a half-supported hashlib algorithm
- elif algorithm in [LDAP_MD5, LDAP_SHA1]:
- alg = algorithm.split('_')[1]
- ahash = decodestring ( activehash.split('}')[1] )
-
- # Hash value is calculated to compare with cracker result
- h = hashlib.new (alg)
- h.update (result)
-
- # If the calculated hash is the same to cracker result, the result is correct (finish!)
- if h.digest() == ahash:
- hashresults.append (result)
- cracked = 2
-
- # If it is a NTLM hash
- elif algorithm == NTLM or (algorithm == LM and ':' in activehash):
- # NTLM Hash value is calculated to compare with cracker result
- candidate = hashlib.new('md4', result.split()[-1].encode('utf-16le')).hexdigest()
-
- # It's a LM:NTLM combination or a single NTLM hash
- if (':' in activehash and candidate == activehash.split(':')[1]) or \
- (':' not in activehash and candidate == activehash):
- hashresults.append(result)
- cracked = 2
-
- # If it is another algorithm, we search in all the crackers
- else:
- hashresults.append(result)
- cracked = 1
-
- # Had the hash cracked?
- if cracked:
- print "\n***** HASH CRACKED!! *****\nThe original string is: %s\n" % (result)
- # If result was verified, break
- if cracked == 2:
- break
- else:
- print "... hash not found in %s\n" % (cr.name)
-
- # Store the result/s for later...
- if hashresults:
-
- # With some hash types, it is possible to have more than one result,
- # Repited results are deleted and a single string is constructed.
- resultlist = []
- for r in hashresults:
- # if r.split()[-1] not in resultlist:
- # resultlist.append (r.split()[-1])
- if r not in resultlist:
- resultlist.append(r)
-
- finalresult = ""
- if len(resultlist) > 1:
- finalresult = ', '.join(resultlist)
- else:
- finalresult = resultlist[0]
-
- # Valid results are stored
- crackedhashes.append((activehash, finalresult))
-
- # Loop is finished. File can need to be closed
- if hashfile:
- try:
- hashestocrack.close()
- except:
- pass
-
- # Show a resume of all the cracked hashes
- print "\nThe following hashes were cracked:\n----------------------------------\n"
- print crackedhashes and "\n".join(
- "%s -> %s" % (hashvalue, result.strip()) for hashvalue, result in crackedhashes) or "NO HASH WAS CRACKED."
- print
-
- return cracked
-
-
-def searchHash(hashvalue):
- '''Google the hash value looking for any result which could give some clue...
-
- @param hashvalue The hash is been looking for.'''
-
- start = 0
- finished = False
- results = []
-
- sys.stdout.write("\nThe hash wasn't found in any database. Maybe Google has any idea...\nLooking for results...")
- sys.stdout.flush()
-
- while not finished:
-
- sys.stdout.write('.')
- sys.stdout.flush()
-
- # 创建查询URL
- url = "http://www.google.com/search?hl=en&q=%s&filter=0" % (hashvalue)
- if start:
- url += "&start=%d" % (start)
-
- # Build the Headers with a random User-Agent
- headers = {"User-Agent": USER_AGENTS[randint(0, len(USER_AGENTS)) - 1]}
-
- # Send the request
- response = do_HTTP_request(url, httpheaders=headers)
-
- # Extract the results ...
- html = None
- if response:
- html = response.read()
- else:
- continue
-
- resultlist = findall(r' %s" % (r)
- print
-
- else:
- print "\n\nGoogle doesn't have any result. Sorry!\n"
-
-
-########################################################################################################
-### MAIN CODE
-########################################################################################################
-
-def main():
- """Main method."""
-
- ###################################################
- # Syntax check
- if len(sys.argv) < 4:
- printSyntax()
- sys.exit(1)
-
- else:
- try:
- opts, args = getopt.getopt(sys.argv[2:], "gh:f:")
- except:
- printSyntax()
- sys.exit(1)
-
- ###################################################
- # Load input parameters
- algorithm = sys.argv[1].lower()
- hashvalue = None
- hashfile = None
- googlesearch = False
-
- for opt, arg in opts:
- if opt == '-h':
- hashvalue = arg
- elif opt == '-f':
- hashfile = arg
- else:
- googlesearch = True
-
- ###################################################
- # Configure the Cookie Handler
- configureCookieProcessor()
-
- # Initialize PRNG seed
- seed()
-
- cracked = 0
-
- ###################################################
- # Crack the hash/es
- cracked = crackHash(algorithm, hashvalue, hashfile)
-
- ###################################################
- # Look for the hash in Google if it was not cracked
- if not cracked and googlesearch and not hashfile:
- searchHash(hashvalue)
-
- # App is finished
- sys.exit()
-
-
-if __name__ == "__main__":
- main()