穷举破解shadow的简单程序(C)

效率一点也不好。。。

 /* ****************************************************
 * $ID: icymoon                                       *
 * $Date: 2006.05.13.                                 *
 * Just a practise                                    *
 * Complie: gcc mcrack.c -o mcrack -lcrypt            *
 * ****************************************************/

#include
#include
#include
#include

#define MAX_DIC 26
#define MAX_PASS 16
#define MIN_PASS 6
//char dic_char[MAX_DIC]= {'1','2','3','4','5','6','7','8','9','0',\
                         'a','b','c','d','e','f','g','h','i','j','k','l','m','n',\
                         'o','p','q','r','s','t','u','v','w','x','y','z'};
//#define MAX_DIC 10
//#define MAX_PASS 10
//#define MIN_PASS 3

//char dic_char[MAX_DIC]= {'1','2','3','4','5','6','7','8','9','0'};
char dic_char[MAX_DIC]= {'a','b','c','d','e','f','g','h','i','j','k','l','m','n',\
                         'o','p','q','r','s','t','u','v','w','x','y','z'};
char sh_file[256];
char shadow_line[256];
char salt[12];
char crypt_passwd[35];
char username[32];

FILE * sh_fp;

//print message & exit
void myexit(char * msg, int quit)
{
        printf("%s\n", msg);
        exit(quit);
}

//Show usage
void usage(char * programme)
{
        printf("Usage: %s       -l -s \n");
        exit(0);
}

//Do crack
int crack(int length)
{
        int i, j, curr_length;
        int count = 0;
        char * guess;
        long dic_index[MAX_DIC];
        int flag;
        char  * check =(char *) malloc(35*sizeof(char));
        for(curr_length = MIN_PASS; curr_length <= length; curr_length ++)
        {
                guess = (char *)malloc(sizeof(char) * (curr_length+1));
                for(j = 0; j < curr_length; j ++)
                        dic_index[j] = 0;
                flag = 1;
                while(flag)
                {
                        count ++;
                        for(j = 0; j < curr_length; j ++)
                                guess[j] = dic_char[dic_index[j]];
                        guess[j] = '\0';
                        check = (char *)crypt(guess, salt);
                        if(!strcmp(crypt_passwd, check))
                        {
                                printf("%s      %s\n", username, guess);
                                return 1;
                        }
                        for(j = curr_length-1; j >= 0; j --)
                        {
                                dic_index[j]++;
                                if(dic_index[j] != MAX_DIC)
                                        break;
                                else
                                {
                                        dic_index[j] = 0;
                                        if(j == 0)
                                                flag = 0;
                                }
                        }
                }
                free(guess);
        }
        free(check);
        return 0;
}

int main(int argc, char * argv[])
{
        int pass_long = 0;
        int opt,line = 0;

        if(argc == 1)
                usage(argv[0]);

        //get and check options
        while((opt = getopt(argc, argv, "hs:l:")) != -1)
        {
                switch(opt)
                {
                        case 'l':
                                pass_long = atoi(optarg);
                                if(pass_long < 0 || pass_long > MAX_PASS)
                                        myexit("The length of password is wrong!", 99);
                                break;
                        case 's':
                                strncpy(sh_file, optarg, sizeof(sh_file));
                                sh_file[sizeof(sh_file) - 1] = '\0';
                                break;
                        case 'h':
                        default:
                                usage(argv[0]);
                                break;
                }
        }
        if(pass_long == 0)
                pass_long = MIN_PASS;
        if((sh_fp = fopen(sh_file, "r")) == NULL)
                myexit("Open shadow file error!", 99);
        while(1)
        {
                memset(shadow_line, '\0', sizeof(shadow_line));
                if(fgets(shadow_line, sizeof(shadow_line), sh_fp) == NULL)
                        break;
                else//get username, crypted password, and salt
                {
                        char * tmp = strchr(shadow_line, '$');
                        char * tmp1;
                        char * tmp2;
                        memset(salt, '\0', sizeof(salt));
                        memset(username, '\0', sizeof(username));
                        line ++;
                        if(tmp == NULL)
                        {
                                printf("Error shadow format, line %d: %s\n", line, shadow_line);
                                continue;
                        }
                        tmp1 = strchr(shadow_line, ':');
                        tmp2 = strchr(tmp1 + 1, ':');
                        *tmp1 = '\0';
                        *tmp2 = '\0';
                        if(strlen(shadow_line) > sizeof(username))
                        {
                                printf("Username too long, line %d\n", line);
                                continue;
                        }
                        strncpy(username, shadow_line, strlen(shadow_line));
                        username[strlen(shadow_line)] = '\0';
                        strncpy(salt, tmp, 12);
                        strncpy(crypt_passwd, tmp, 34);
                        crypt_passwd[34] = '\0';
                        crack(pass_long);
                }
        }
}