MySQL dictionary-based hash cracker

mysql-crack.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (C) 2009 Francesco Piccinno <[email protected]>
#
# Author: Francesco Piccinno <[email protected]>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

import sys
import struct

try:
    import psyco
    psyco.full()
except ImportError:
    print "Install python-psyco to get a speed burst :)"

try:
    from hashlib import sha1
except ImportError:
    from sha import new as sha1

int1read = lambda c: int('%02x' % ord(c),16)

# This is ripped from mysql-connector-python (https://code.launchpad.net/myconnpy)
def crypt(password, seed):
    hash1 = sha1(password).digest()
    hash2 = sha1(hash1).digest()
    hash3 = sha1(seed + hash2).digest()
    xored = [ int1read(h1) ^ int1read(h3) for (h1,h3) in zip(hash1, hash3) ]
    hash4 = struct.pack('20B', *xored)

    return hash4

def hex_to_byte(hex_str):
    bytes = []
    for i in range(0, len(hex_str), 2):
        bytes.append(chr(int(hex_str[i:i+2], 16)))
    return ''.join(bytes)

if len(sys.argv) != 3:
	print "Usage: %s <hex_response:hex_challenge> <wordlist>" % sys.argv[0]
        print "Example:"
        print "    $ ./mysql-crack.py b578d2cd087b432ab88dc1ace85e06a9d86831f7:3d796a2a2e4a6a56517370584638234570297430 /usr/share/john/password.lst"
        print "    Password is: test"
	sys.exit(1)

pw = sys.argv[1]

if len(pw) != 81:
	print "Improper hash length"
  	sys.exit(1)

response, challenge = pw.split(':', 1)

if len(challenge) != 40 or len(response) != 40:
    print "Invalid hash format"
    sys.exit(1)

challenge, response = map(hex_to_byte, (challenge, response))

try:
  	words = open(sys.argv[2], "r")
except IOError:
  	print "Error: Check your wordlist path"
  	sys.exit(1)


for word in words.xreadlines():
    if response == crypt(word.strip(), challenge):
        print "Password is:", word.strip()
        sys.exit(0)