Skip to content

Instantly share code, notes, and snippets.

@mj-hd
Created August 14, 2015 20:07
Show Gist options
  • Save mj-hd/0727bbea80104fdd0269 to your computer and use it in GitHub Desktop.
Save mj-hd/0727bbea80104fdd0269 to your computer and use it in GitHub Desktop.
Brute-force attack for php's crypt
<?php
$hash = "encrypted hash";
$salt = "salt";
$digits = 8;
$thread_n = 4;
$threads = [];
for ($i = 0; $i < $thread_n; $i++) {
$threads[$i] = new AttackThread($i, $thread_n, $hash, $salt, $digits);
$threads[$i]->start();
}
$finished = false;
while (!$finished) {
sleep(1);
$finished = true;
for ($i = 0; $i < $thread_n; $i++) {
$finished &= !$threads[$i]->isRunning();
}
}
echo "done\n";
class AttackThread extends Thread {
public $id;
public $from;
public $to;
private $table = ['', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'n', 'm', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'];
private $char_qty;
private $pows = [];
private $hash;
private $salt;
private $digits;
public function __construct($id, $thread_n, $hash, $salt, $digits) {
$this->id = $id;
$this->hash = $hash;
$this->salt = $salt;
$this->digits = $digits;
$this->char_qty = count($this->table);
// WORK AROUND
$pows = [];
for ($i = 0; $i <= $this->digits; $i++) {
$pows[] = pow($this->char_qty, $i);
}
$this->pows = $pows;
$per = intval($this->pows[$this->digits]/$thread_n);
$this->from = $per*$this->id;
$this->to = $per*($this->id+1);
}
public function run() {
$attempt = [];
$count = 0;
$per = ($this->to - $this->from) / 100;
echo "Thread#$this->id started From:$this->from To:$this->to\n";
for ($i = $this->from; $i < $this->to; $i++) {
if (($i - $this->from) % $per == 0) {
echo "Thread#$this->id -- $count %\n";
$count++;
}
for ($j = 0; $j < $this->digits; $j++) {
$attempt[$j] = $this->table[($i / $this->pows[$j]) % $this->char_qty];
}
if (crypt(implode($attempt), $this->salt) == $this->hash) {
echo "Thread#$this->id -- Solved: ".implode($attempt)."\n";
exit(1);
}
}
echo "Thread#$this->id finished\n";
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment