# it's working on Linux System only !! # Dis: get salt from hash and use it agin with password to genrate a hash with same salt # last step compare with hash # hash e.g. : $1$sm1RceCh$rSd3PygnS/6jlFDfF2J5q. => password is : deadbolt from crypt import * import sys def crack_password(hash,wordlist): hashed_pwd = hash lindex = hashed_pwd.rfind('$') hash_algorithm = hashed_pwd[1:2] salt = hashed_pwd[3:lindex] salt_format = "${}${}$".format(hash_algorithm, salt) Raw_Password = open(wordlist, "r") for rawPass in Raw_Password: try: hashOutPut = crypt(rawPass.split()[0], salt_format) if hashOutPut == hashed_pwd: print("[+] Found Pasword : {}".format(rawPass.split()[0])) break except: pass if len(sys.argv) !=3: print("[!] Usage : {} ".format(sys.argv[0])) print("[+] Note : Please don't forget to escape special chars !!") print("[+] e.g. : {} \"\$1\$sm1RceCh\$rSd3PygnS/6jlFDfF2J5q.\" \"./wordlist/rockyou.txt\"".format(sys.argv[0])) sys.exit(1) Hash = sys.argv[1] WorlListPath = sys.argv[2] crack_password(Hash,WorlListPath)