#!usr/bin/perl
use Digest::MD5  qw(md5_hex);
use Digest::SHA1  qw(sha1_hex);

# Author: localh0t
# Date: 09/06/11
# Contact: mattdch0@gmail.com
# Follow: @mattdch

# Help

if(!$ARGV[7])
	{
		 print "\n\n###########################################";
		 print "\n# Multi CMS Hash Cracker v0.1 by localh0t #";
         	 print "\n###########################################";
		 print "\n\nUse: perl $0 -d [WORLDLIST FOLDER] -h [MD5 | SHA-1 HASH] -s [SALT | USERNAME] -c [CMS]\n";
		 print "Example: perl $0 -d /home/localh0t/wordlists/ -h caef8544a8e65e23f67ab844d4866e8d -s uZ*qX -c IPB\n";
		 print "Example: perl $0 -d /home/localh0t/wordlists/ -h dc4a27b25e3f780b89c165f931d6f85d5bd6e33e -s Administrator -c SMF\n\n";
		 print "Note: Worlists must end with .txt or .lst (or any extension)\n\n";	
		 print "Support:\n========\n";
		 print "VB     : md5_hex(md5_hex(password).salt)           | (vBulletin)\n";
		 print "SMF    : sha1_hex(user.password)                   | (Simple Machines Forum)\n";
		 print "IPB    : md5_hex(md5_hex(salt).md5_hex(password))  | (Invision Power Board)\n";
		 print "JOOMLA : md5_hex(password.salt)                    | (Joomla 1.x)\n\n";
		 exit(0);
	}


# Functions

sub ipb_cracker{
	my $hash = shift;
	my $salt = shift;
	my $dir  = shift;
	foreach $file (@FILES) {
	open(DICT,"<".$dir.$file) || die "\n[-] Error opening $file\n\n";
	print "[!] Using $file...\n";
			foreach $password(<DICT>) {
				$password=~s/\s|\n//;
				chomp($password);
				$cracked = md5_hex(md5_hex($salt).md5_hex($password));
				if ($cracked eq $hash) {
					return "[+] Hash cracked !: $password\n\n";
				}
			}
	print "[!] Nothing found with $file...\n\n";
	}
	return "\n[-] Password not found\n\n";
}

sub vb_cracker{
	my $hash = shift;
	my $salt = shift;
	my $dir  = shift;
	foreach $file (@FILES) {
	open(DICT,"<".$dir.$file) || die "\n[-] Error opening $file\n\n";
	print "[!] Using $file...\n";
			foreach $password(<DICT>) {
				$password=~s/\s|\n//;
				chomp($password);
				$cracked = md5_hex(md5_hex($password).$salt);
				if ($cracked eq $hash) {
					return "[+] Hash cracked !: $password\n\n";
				}
			}
	print "[!] Nothing found with $file...\n\n";
	}
	return "\n[-] Password not found\n\n";
}

sub smf_cracker{
	my $hash = shift;
	my $user = shift;
	my $dir  = shift;
	foreach $file (@FILES) {
	open(DICT,"<".$dir.$file) || die "\n[-] Error opening $file\n\n";
	print "[!] Using $file...\n";
			foreach $password(<DICT>) {
				$password=~s/\s|\n//;
				chomp($password);
				$cracked = sha1_hex($user.$password);
				if ($cracked eq $hash) {
					return "[+] Hash cracked !: $password\n\n";
				}
			}
	print "[!] Nothing found with $file...\n\n";
	}
	return "\n[-] Password not found\n\n";
}

sub joomla_cracker{
	my $hash = shift;
	my $salt = shift;
	my $dir  = shift;
	foreach $file (@FILES) {
	open(DICT,"<".$dir.$file) || die "\n[-] Error opening $file\n\n";
	print "[!] Using $file...\n";
			foreach $password(<DICT>) {
				$password=~s/\s|\n//;
				chomp($password);
				$cracked = md5_hex($password.$salt);
				if ($cracked eq $hash) {
					return "[+] Hash cracked !: $password\n\n";
				}
			}
	print "[!] Nothing found with $file...\n\n";
	}
	return "\n[-] Password not found\n\n";
}

my ($dir, $hash, $salt, $cms, $arg);

foreach $loop (@ARGV) {
	for ($loop) {
		/^-d$/ and do { $dir = $ARGV[($arg+1)]; last; };
		/^-h$/ and do { $hash = $ARGV[($arg+1)];  last; };
		/^-s$/ and do { $salt = $ARGV[($arg+1)]; last; };
		/^-c$/ and do { $cms = $ARGV[($arg+1)]; last; };
	}
	$arg++;
}


# Main

print "\n[!] Cracking $hash with $salt as username/salt...\n\n";

opendir(DIR, $dir) || die "\n[-] Folder not found\n\n";

while($file = readdir(DIR)) {
     if ($file ne '.' and $file ne '..') {
	$FILES[$clean] = $file;
	$clean++;
     }
}

for ($cms) {
  /^IPB$/    and do { $result = &ipb_cracker($hash,$salt,$dir); last; };
  /^VB$/     and do { $result = &vb_cracker($hash,$salt,$dir);  last; };
  /^SMF$/    and do { $result = &smf_cracker($hash,$salt,$dir); last; };
  /^JOOMLA$/ and do { $result = &joomla_cracker($hash,$salt,$dir); last; };
  /^.$/      and do { print "[-] CMS not available\n"; exit(0); last; };
}

print $result;

# Exit

close(DICT);
closedir(DIR);
exit(0);

__END__