MINZKN의 블로그

span class=postbody이 소스는 간단히 현재 사용자명과 암호가 같은 경우를 검출하는 것입니다. br /즉, 사용자명이 test 인데 암호도 test이면 딱 걸립니다. br /br /사전식 및 조합식으로 암호를 역 추출하는 예제도 함께 있습니다. br /br /테스트하실때는 root 유저로 로그인해서 하셔야 한다는것 잊지마세요. br /br /첨부파일 참고. br /br /관련글: br /a class=postlink href=http://blog.naver.com/minzkn/60019724785 target=_blankhttp://blog.naver.com/minzkn/60019724785/a br /a class=postlink href=http://www.joinc.co.kr/modules.php?op=modloadamp;name=Forumamp;file=viewtopicamp;topic=31254amp;forum=1 target=_blankhttp://www.joinc.co.kr/modules.php?op=modloadamp;name=Forumamp;file=viewtopicamp;topic=31254amp;forum=1/a br /a class=postlink href=https://bbs.minzkn.com/viewtopic.php?p=466#466 target=_blankhttps://bbs.minzkn.com/viewtopic.php?p=466#466/a br /a class=postlink href=https://bbs.minzkn.com/viewtopic.php?t=438 target=_blankhttps://bbs.minzkn.com/viewtopic.php?t=438/a br /br //span table align=center border=0 cellpadding=3 cellspacing=1 width=90% tbody tr tdspan class=genmedb코드:/b/span/td/tr tr td class=code/* br /nbsp; Copyright (C) Information Equipment co.,LTD br /nbsp; All rights reserved. br /nbsp; Code by JaeHyuk Cho lt;mailto:minzkn@infoeq.comgt; br /nbsp; CVSTAG=$Header$ br /*/ br /br /#include lt;sys/types.hgt; br /#include lt;stdio.hgt; br /#include lt;string.hgt; br /#include lt;pwd.hgt; br /#include lt;shadow.hgt; br /#include lt;unistd.hgt; br /#include lt;crypt.hgt; br /br /int main(void) br /{ br /nbsp;struct passwd *s_password_entry; br /nbsp;struct spwd *s_shadow_entry; br /nbsp;size_t s_pwdp_size; br /nbsp;char s_salt[13]; br /nbsp;const char *s_crypt; br /nbsp;setpwent(); br /nbsp;do br /nbsp;{ br /nbsp; s_password_entry = getpwent(); br /nbsp; if(s_password_entry == ((struct passwd *)0))break; br /#if 0 /* DEBUG */ br /nbsp; (void)fprintf(stdout, br /nbsp; nbsp;name=\%s\, passwd=\%s\, uid=%u, gid=%u, gecos=\%s\, dir=\%s\, shell=\%s\\n, br /nbsp; nbsp;s_password_entry-gt;pw_name, s_password_entry-gt;pw_passwd, (unsigned int)s_password_entry-gt;pw_uid, (unsigned int)s_password_entry-gt;pw_gid, s_password_entry-gt;pw_gecos, s_password_entry-gt;pw_dir, s_password_entry-gt;pw_shell br /nbsp; ); br /#endif br /nbsp; setspent(); br /nbsp; do br /nbsp; { br /nbsp; nbsp;s_shadow_entry = getspent(); br /nbsp; nbsp;if(s_shadow_entry == ((struct spwd *)0))break; br /nbsp; nbsp;if(strcmp(s_password_entry-gt;pw_name, s_shadow_entry-gt;sp_namp) == 0) br /nbsp; nbsp;{ br /nbsp; nbsp; s_pwdp_size = strlen(s_shadow_entry-gt;sp_pwdp); br /nbsp; nbsp; s_salt[0] = '\0'; br /nbsp; nbsp; if(s_pwdp_size gt; ((size_t)0)) br /nbsp; nbsp; { br /nbsp; nbsp; nbsp;if(s_shadow_entry-gt;sp_pwdp[0] == '$') br /nbsp; nbsp; nbsp;{ br /nbsp; nbsp; nbsp; if((s_pwdp_size gt; ((size_t)12)) amp;amp; (s_shadow_entry-gt;sp_pwdp[2] == '$') amp;amp; (s_shadow_entry-gt;sp_pwdp[11] == '$')) br /nbsp; nbsp; nbsp; { br /nbsp; nbsp; nbsp; nbsp;(void)memcpy((void *)(amp;s_salt[0]), (void *)(amp;s_shadow_entry-gt;sp_pwdp[0]), (size_t)12); br /nbsp; nbsp; nbsp; nbsp;s_salt[12] = '\0'; br /nbsp; nbsp; nbsp; } br /nbsp; nbsp; nbsp;} br /nbsp; nbsp; nbsp;else if(s_pwdp_size gt; ((size_t)2)) br /nbsp; nbsp; nbsp;{ br /nbsp; nbsp; nbsp; (void)memcpy((void *)(amp;s_salt[0]), (void *)(amp;s_shadow_entry-gt;sp_pwdp[0]), (size_t)2); br /nbsp; nbsp; nbsp; s_salt[2] = '\0'; br /nbsp; nbsp; nbsp;} br /nbsp; nbsp; } br /nbsp; nbsp; s_crypt = crypt(s_shadow_entry-gt;sp_namp, (char *)(amp;s_salt[0])); br /#if 0 /* DEBUG */ br /nbsp; nbsp; (void)fprintf(stdout, br /nbsp; nbsp; nbsp;\tpwdp=\%s\, lstchg/min/max/warn/inact/expire/flag=%ld/%ld/%ld/%ld/%ld/%ld/%08lXH\n\tcrypt=\%s\\n, br /nbsp; nbsp; nbsp;s_shadow_entry-gt;sp_pwdp, (long)s_shadow_entry-gt;sp_lstchg, (long)s_shadow_entry-gt;sp_min, (long)s_shadow_entry-gt;sp_max, (long)s_shadow_entry-gt;sp_warn, (long)s_shadow_entry-gt;sp_inact, (long)s_shadow_entry-gt;sp_expire, (unsigned long)s_shadow_entry-gt;sp_flag, s_crypt); br /#else br /nbsp; nbsp; if(strcmp(s_shadow_entry-gt;sp_pwdp, s_crypt) == 0)(void)fprintf(stdout, %s (%s) account detected\n, s_password_entry-gt;pw_name, s_password_entry-gt;pw_dir); br /#endif br /nbsp; nbsp; break; br /nbsp; nbsp;} br /nbsp; }while(1); br /nbsp; endspent(); br /nbsp; (void)fflush(stdout); br /nbsp;}while(1); br /nbsp;endpwent(); br /nbsp;(void)memset((void *)(amp;s_salt[0]), 0, sizeof(s_salt)); br /nbsp;return(0); br /} br /br //* vim: set expandtab: */ br //* End of source *//td/tr/tbody/tablespan class=postbodybr /br /br /br /hash 를 이용한 방법 br //span table align=center border=0 cellpadding=3 cellspacing=1 width=90% tbody tr tdspan class=genmedb코드:/b/span/td/tr tr td class=codebr //* br /nbsp; Copyright (C) Information Equipment co.,LTD br /nbsp; All rights reserved. br /nbsp; Code by JaeHyuk Cho lt;mailto:minzkn@infoeq.comgt; br /nbsp; CVSTAG=$Header$ br /*/ br /br /#include lt;sys/types.hgt; br /#include lt;stdio.hgt; br /#include lt;stdlib.hgt; br /#include lt;string.hgt; br /#include lt;pwd.hgt; br /#include lt;shadow.hgt; br /#include lt;unistd.hgt; br /#include lt;crypt.hgt; br /br /#include hash.h br /br /#define def_pwentry_debug (1) br /br /struct ts_shadow br /{ br /nbsp;struct ts_shadow *next; br /nbsp;char *namp; br /nbsp;char *pwdp; br /nbsp;char *crypt; br /}; br /br /struct ts_shadow * (load_shadow)(struct ts_mzapi_hash *s_hash) br /{ br /nbsp;struct ts_shadow *s_shadow = (struct ts_shadow *)0, *s_new; br /nbsp;struct spwd *s_spwd; br /nbsp;size_t s_pwdp_size; br /nbsp;char s_salt[13]; br /nbsp;setspent(); br /nbsp;do br /nbsp;{ br /nbsp; s_spwd = getspent(); br /nbsp; if(s_spwd == ((struct spwd *)0))break; br /nbsp; s_new = (struct ts_shadow *)malloc((size_t)sizeof(struct ts_shadow)); br /nbsp; if(s_new == ((struct ts_shadow *)0))continue; br /nbsp; s_new-gt;next = s_shadow; br /nbsp; s_new-gt;namp = strdup(s_spwd-gt;sp_namp); br /nbsp; s_new-gt;pwdp = strdup(s_spwd-gt;sp_pwdp); br /nbsp; s_pwdp_size = strlen(s_spwd-gt;sp_pwdp); br /nbsp; s_salt[0] = '\0'; br /nbsp; if(s_pwdp_size gt; ((size_t)0)) br /nbsp; { br /nbsp; nbsp;if(s_spwd-gt;sp_pwdp[0] == '$') br /nbsp; nbsp;{ br /nbsp; nbsp; if((s_pwdp_size gt; ((size_t)12)) amp;amp; (s_spwd-gt;sp_pwdp[2] == '$') amp;amp; (s_spwd-gt;sp_pwdp[11] == '$')) br /nbsp; nbsp; { br /nbsp; nbsp; nbsp;(void)memcpy((void *)(amp;s_salt[0]), (void *)(amp;s_spwd-gt;sp_pwdp[0]), (size_t)12); br /nbsp; nbsp; nbsp;s_salt[12] = '\0'; br /nbsp; nbsp; } br /nbsp; nbsp;} br /nbsp; nbsp;else if(s_pwdp_size gt; ((size_t)2)) br /nbsp; nbsp;{ br /nbsp; nbsp; (void)memcpy((void *)(amp;s_salt[0]), (void *)(amp;s_spwd-gt;sp_pwdp[0]), (size_t)2); br /nbsp; nbsp; s_salt[2] = '\0'; br /nbsp; nbsp;} br /nbsp; } br /nbsp; s_new-gt;crypt = strdup(crypt(s_spwd-gt;sp_namp, (char *)(amp;s_salt[0]))); br /nbsp; s_shadow = s_new; br /nbsp; (void)s_hash-gt;add(s_hash, s_hash-gt;function(s_hash, (void *)s_spwd-gt;sp_namp, strlen(s_spwd-gt;sp_namp)), (void *)s_new); br /nbsp;}while(1); br /nbsp;endspent(); br /nbsp;return(s_shadow); br /} br /br /struct ts_shadow * (free_shadow)(struct ts_shadow *s_shadow) br /{ br /nbsp;struct ts_shadow *s_prev; br /nbsp;while(s_shadow != ((struct ts_shadow *)0)) br /nbsp;{ br /nbsp; s_prev = s_shadow; br /nbsp; s_shadow = s_shadow-gt;next; br /nbsp; if(s_prev-gt;crypt != ((char *)0))free((void *)s_prev-gt;crypt); br /nbsp; if(s_prev-gt;pwdp != ((char *)0))free((void *)s_prev-gt;pwdp); br /nbsp; if(s_prev-gt;namp != ((char *)0))free((void *)s_prev-gt;namp); br /nbsp; free((void *)s_prev); br /nbsp;} br /nbsp;return((struct ts_shadow *)0); br /} br /br /int main(void) br /{ br /nbsp;struct ts_mzapi_hash *s_shadow_hash; br /nbsp;struct ts_shadow *s_shadow, *s_this; br /nbsp;struct passwd *s_passwd; br /nbsp;struct ts_mzapi_hash_node *s_hash_node; br /nbsp;s_shadow_hash = mzapi_open_hash(256); br /nbsp;if(s_shadow_hash != ((struct ts_mzapi_hash *)0)) br /nbsp;{ br /nbsp; s_shadow = load_shadow(s_shadow_hash); br /nbsp; if(s_shadow != ((struct ts_shadow *)0)) br /nbsp; { br /nbsp; nbsp;setpwent(); br /nbsp; nbsp;do br /nbsp; nbsp;{ br /nbsp; nbsp; s_passwd = getpwent(); br /nbsp; nbsp; if(s_passwd == ((struct passwd *)0))break; br /nbsp; nbsp; s_hash_node = s_shadow_hash-gt;search_by_key(s_shadow_hash, br /nbsp; nbsp; nbsp;s_shadow_hash-gt;function(s_shadow_hash, (void *)s_passwd-gt;pw_name, strlen(s_passwd-gt;pw_name))); br /nbsp; nbsp; while(s_hash_node != ((struct ts_mzapi_hash_node *)0)) br /nbsp; nbsp; { br /nbsp; nbsp; nbsp;s_this = (struct ts_shadow *)s_hash_node-gt;vector; br /nbsp; nbsp; nbsp;if(strcmp(s_passwd-gt;pw_name, s_this-gt;namp) == 0)break; br /nbsp; nbsp; nbsp;s_hash_node = s_shadow_hash-gt;next_search(s_shadow_hash, s_hash_node); br /nbsp; nbsp; } br /nbsp; nbsp; if(s_hash_node == ((struct ts_mzapi_hash_node *)0))continue; br /nbsp; nbsp; if(strcmp(s_this-gt;pwdp, s_this-gt;crypt) != 0)continue; br /nbsp; nbsp; (void)fprintf(stdout, warning: \x1b[1;31m%s\x1b[0m (%s) account detected\n, s_passwd-gt;pw_name, s_passwd-gt;pw_dir); br /nbsp; nbsp;}while(1); br /nbsp; nbsp;endpwent(); br /nbsp; nbsp;s_shadow = free_shadow(s_shadow); br /nbsp; } br /nbsp; else (void)fprintf(stdout, error: shadow\n); br /nbsp; s_shadow_hash = mzapi_close_hash(s_shadow_hash); br /nbsp;} br /nbsp;else (void)fprintf(stdout, error: hash\n); br /nbsp;return(0); br /} br /br //* vim: set expandtab: */ br //* End of source *//td/tr/tbody/table

크리에이티브 커먼즈 라이센스

이 저작물은 크리에이티브 커먼즈 코리아 저작자표시-비영리-동일조건변경허락 2.0 대한민국 라이센스에 따라 이용하실 수 있습니다.