demo_weak_ssh-keygen_defaults.sh

#!/bin/bash

# Init
WORDLIST=/usr/share/dict/words
WORDLIST_N=${1:-1500}
FILE=/dev/shm/f
COUNTER=0
FOUND=""

# Min 5 chars
tmp=$(mktemp)
shuf -n $WORDLIST_N $WORDLIST | awk 'length($0)>5' > $tmp
WORDLIST=$tmp

# Gen key
rm -rf $FILE
SECRET=$(shuf -n 1 $WORDLIST)
ssh-keygen -t rsa -N "$SECRET" -f $FILE

# Init loop
iv=$(awk -F, '/DEK-Info/ {print $2}' $FILE)
key_suffix=$(cut -c-16 <<< $iv | xxd -r -p)
grep -v '^$\|-' $FILE | base64 -d > /dev/shm/b

# Bruteforce
start_timer=$(date +%s)
while read -r passphrase
do
  (( COUNTER++ ))
  echo "$COUNTER, Testing $passphrase"
  < /dev/shm/b openssl aes-128-cbc -d -iv $iv -K $(printf "$passphrase$key_suffix" | md5sum | cut -c -32) 2> /dev/null > /dev/shm/o
  [[ $? -eq 0 ]] && { # Check for false-positive
    < /dev/shm/o openssl asn1parse -inform DER &> /dev/null
    [[ $? -eq 0 ]] && echo FOUND && break
  }
done < $WORDLIST

# Stats
end_timer=$(date +%s)
seconds=$((end_timer-start_timer))
[[ $seconds -eq 0 ]] && seconds=1
hps=$((COUNTER/seconds))
awk -v t=$seconds 'BEGIN{t=int(t*1000); printf "Found in %02d:%02d\n", t/60000%60, t/1000%60}'
echo "$hps tries per second"