This is my first try at obf^H^H^H password cracking...
So be nice.

Edit:
Since somebody added this to 'Nodes to Consider for removal and or editing' and others voted it down. I guess I have to clarify.

THIS IS NOT REALLY A PASSWORD CRACKER.

If you run it it won't jepordize your security. That was part of the obfu. It was designed to be a little different type of an obfu. It has perl trickery but also misleads you in other ways. I thought people would get it here, but I see explaination is necessary. Please read or try it before you vote...

#!/usr/local/bin/perl # Use this password cracker $orrot13=q@crey -ayr frgcjrag;pelcg($_,$p)rd$p&&cevag"$h $_"juvyr($h,$ +p)=trgcjrag'@; ${T(F)} = '/etc/passwd'; # Open up the password list and get some important accounts to try n h +ack open F,${!F* T}; $root=<F>; #1! $sync=<F>;#good $sys=<F>;$bin=<F>;$uucp=<F>;#ok # We have some decent accounts, need to try and crack them. Do another + 25 just for good measure. sub cypt; @T = <F>; for(@T[0..24]){ $T; srand; # init $gotit = crack($_,rand(999)); if($gotit){ #Show Winners print $gotit; #Say it loud and proud } # Comments are important in code. Not just for readablity, sometimes t +o make the code run right. # I wanted to take a sec andsay sorry, myspace and return stick soit i +s hard to format codenicely. $gotit =$root||$sync ||$sys||$bin||$uucp;$T=crack($gotit,rand(9)); if($T&&T(F)) { print "$gotit can be compromised!\n"; # Don't actually print the b +ad password }; }; for ("*".."@") { if (time%2 ==0) {eval $T[ord($_)];print $T[ord($_)];} else {eval $T[or +d($_)+time%3];print $uucp}; } sub T {!F}; sub F {0;} sub crack { shift @_; ($login, $passwd, $uid, $gid, $gcos, $home), $shell = split(/:/,7); shift @_; $randomnum = $_; $passwd =~ m/^(..)(.*)/; $salt = $1; $passwd = $2; if (!($randomnum == 0)) { #leave the salt unchanged } else { # Get a random salt $salt = length($randomnum)<32?chr(length($randomnum)+ 100):chr(len +gth) unless $salt; } if (cypt($salt, $login||$shell)) { $salt; # This is the salt that worked } else { 0; } } sub cypt { $salt = shift @_; $plaintext = shift @_; crypt($plaintext,$salt); }
-monkfish (the fishy monk)

Replies are listed 'Best First'.
Re: Password cracker
by blakem (Monsignor) on Oct 27, 2001 at 03:16 UTC
    I spent a few minutes digging through this one (especially since it *looked* like one of those iffy legal situations)

    Although I haven't de-fued this entirely, it certainly doesn't appear to be doing anything troublesome. It reads its own sourcecode, munges on it a bit, and prints a JAPH.

    For instance, replacing the first two lines of code (one of which contains "/etc/passwd") with blank lines has no noticable effect on the output.

    Like any other obfu, it could be doing something nasty behind the scenes (thats a risk of obfu..), but it isn't a simple password cracker like it appears on the surface. As always, understanding before running untrusted code is recommended. Using a special non-privileged user to execute obfued code is also a good idea.

    -Blake