1

Here's my script:

#!/bin/bash

#read password.lst, hash each word, store in variable and check it against our hash

target_hash="14a4b8e7ae966e72a3a2c51633bfabc6"
password_lst=/usr/share/metasploit-framework/data/wordlists/password.lst

while IFS= read -r password
  do
    hashed_password=printf $password | /usr/bin/md5sum | cut -d  " " -f 1

    if [ $hashed_password == $target_hash ]
                then 
                        printf "==========================\n"
                        printf "Found Password: $password\n"
                        printf "==========================\n"
                        break
                else 
                        printf "Password: $password\n"
                        printf "Target hash: $target_hash\n"
                        printf "Current Hash: $hashed_password\n"
        fi

done < "$password_lst"

The purpose is to hash each word in the file password.lst, check it against the target_hash and if it's correct, output the correct password and until the loop gets there, output what hash it's currently working on.

I keep getting errors in lines 10 and 12. Does anyone know what could be wrong and how I can fix it?

Lauren Yim
  • 12,700
  • 2
  • 32
  • 59
echo_LOGNAME
  • 11
  • 2
  • 2
    Please paste your script at [shellcheck.net](http://www.shellcheck.net/) and try to implement the recommendations made there. – Cyrus Mar 02 '22 at 19:10

1 Answers1

0

I think this line doesn't work the way you might think:

hashed_password=printf $password | /usr/bin/md5sum | cut -d  " " -f 1

The shell sees this as:

  • Set the env var hashed_password to printf and then run $password (that is, expand the variable and run the value as a command) with that env vars set
  • Pipe the results of the previous step into /usr/bin/md5sum
  • Pipe the results of the previous step into cut ....

What I think you want is to evaluate the whole thing and assign the result into hashed_pasword? If so, you need to use this form:

var=$(evaluate this thing and assign it to the var)

So:

hashed_password=$(printf $password | /usr/bin/md5sum | cut -d  " " -f 1)
omajid
  • 14,165
  • 4
  • 47
  • 64
  • 1
    Note that `printf $password` is wrong -- it should be `printf '%s' "$password"` if you want to emit the variable contents literally with no trailing newline; as it is, it'll try to treat backslashes, `%`s, etc as format-string elements. – Charles Duffy Oct 19 '22 at 23:39