Jump to content
begood

[0-day] MegaCracker 0.1a - Tue, 22 Jan 2013 07:26:01 UTC

Recommended Posts

Cracks a Mega password from a confirmation link. Do NOT post your confirmation

link because it contains not only a hash of your password but your encrypted

master key. Once the master key is disclosed all your file can be decrypted.

./megacracker-64 [options]

-h|--hash=<string>

Confirmation link.

-H|--hash-file=<file>

File with confirmation links.

--help

Display help and exit.

-i|--input=<file>

File with passwords to test [default is stdin].

-I|--input-precomp=<file>

File with pregenerated data.

-o|--output=<file>

Output data to use later.

Copyright © 2013 Steve Thomas <steve AT tobtu DOT com>

This is free software: you can redistribute it and/or modify it under the

terms of the GNU General Public License as published by the Free Software

Foundation, either version 2 of the License, or (at your option) any later

version. There is NO WARRANTY, to the extent permitted by law.

---------------

There are at least six things in the confirmation link:

* Encrypted master key (16 bytes)

* Password hash (16 bytes)

* Unknown field (15 bytes?)

* Email address

* Name

* Unknown field (8 bytes?)

This will extract the password hash and crack it.

This will except confirmation links in these forms (You can truncate the data after #confirm to 43 characters):

* https://mega.co.nz/#confirm...........................................

* mega.co.nz/#confirm...........................................

* #confirm...........................................

* ...........................................

If you want to generate some you can run this in your web browser's console:

var pw_aes = new sjcl.cipher.aes(prepare_key_pw("password"));

base64urlencode(

a32_to_str(

encrypt_key(pw_aes, [rand(0x100000000),rand(0x100000000),rand(0x100000000),rand(0x100000000)]))+

a32_to_str(

encrypt_key(pw_aes, [rand(0x100000000),0,0,rand(0x100000000)])));

dqKqDkwkeaJZCSm8gOUTRsgil2fSec1H4J0i2Z8aIbg

This is a precomputed list of passwords. You can use this with -I|--input-precomp:

https://mega.co.nz/#!rYkkTYzA!B_qWf18rDV4NrXAFM4vwwCdYhvRY14zkFyMITAMQSeY

http://www.tobtu.com/files/megacracker.zip

website : https://mega.co.nz/

Edited by begood
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...