<?php die(); /* XSS SHIELD, REMOVE THIS LINE */ ?>
<?
##########################################################################
# How to run:  (INSTALL PHP) (WINDOWS: www.php4win.de / UNIX: www.php.net)
#
#  USAGE: php md5ripper.php THEHASH LENGTH_OF_WORD_TO_FOUND
#
##########################################################################

set_time_limit(0);

print "PHP MD5/DES Bruteforcer v1.0\r\n";
print "------------------------\r\n";

if ($argc!=3) {
  die ("USAGE: php butt02.php MD5_HASH CHARS\r\n\r\n- MD5_HASH : The hash to crack\r\n- CHARS    : presumed length of the password to crack\r\n");
  }

$HASH = $argv[1];
$SIZE = (int) $argv[2];
$start = strtotime ("now");
$start2 = strtotime ("now");
$keyspace = pow(75,$SIZE);
########## GEN first KEY ##################
$key = "";
for ($y=0;$y<$SIZE;$y++) {
  $key = $key . "0";
  }
###########################################

print "*** Using SIZE: $SIZE, cracking HASH: $HASH\r\n";
print "*** Presumed KeySpace: ".$keyspace."\r\n\r\n";

for ($x=0;$x<$keyspace;$x++)  {
  ########## GEN NEW KEY ##################
  for ($y=0;$y<$SIZE;$y++) {
    if ($key[$y] != "z")  {
      $key[$y] = chr(ord($key[$y])+1);
      #$key = md5($key);
      if ($y > 0) {
        for ($z = 0; $z < $y; $z++) $key[$z] = "0";
        }
      break;
      }
    }
  #########################################

  $key2 = md5($key); # using pure md5
  #$key2 = crypt($key); # using DES (classic one)

  ##### SEE http://www.php.net/crypt to modify the line and add SALTS

  if ($HASH==$key2) {
    die ("\r\n!!! Found MATCHING WORD: $key !!! \r\nTook ".date("H:i:s",mktime(0,0,strtotime("now")-$start2))."\r\n");
    }

  if ($x % 24000 == 0) {
    $x2++;
    if ($x2 == 4) {
      $x2 =0;
      $time = strtotime ("now") - $start;
      $start = strtotime("now");
      if ($time==0) $time=1;
      $rate = (24000 *4) / $time;
      print "... $x/$keyspace ($key) [$rate Keys/sec]\r\n";
      }
    }
  }
print "NO MATCHS FOUND :( (SIZE is not correct?)\r\nTook ".date("H:i:s",mktime(0,0,strtotime("now")-$start2))."\r\n";
?>