<?php
  
      set_time_limit(0);
   
      echo &amp;quot;///////////////////////////////////////////////\r\n&amp;quot;;
 
      echo &amp;quot;//         PHPBB3 Bruteforce             //\r\n&amp;quot;;

      echo &amp;quot;//  Original bruteforce script by Tux      //\r\n&amp;quot;;
 
      echo &amp;quot;//     Moded for Phpbb3 by Jeforce     //\r\n&amp;quot;;

      echo &amp;quot;//     http://www.jeforce.net            //\r\n&amp;quot;;
 
      echo &amp;quot;////////////////////////////////////////////\r\n&amp;quot;;

      if ($argc&lt;2 || $argv[1]=='--help') {

          echo&lt;&lt;&lt;END
  
      USAGE: {$argv[0]} 'hash' chars
 
          - hash        : The hash to crack
 
          - chars        : Max length string to attempt to crack

      HELP: {$argv[0]} --help
 
      END;

          exit;
 
      }

      //Fonction PHPBB3
 
      function _hash_crypt_private($password, $setting, &amp;$itoa64)
  
      {
  
      $output = '*';

      // Check for correct hash
 
      if (substr($setting, 0, 3) != '$H$')
 
      {return $output;}

      $count_log2 = strpos($itoa64, $setting[3]);
 
      if ($count_log2 &lt; 7 || $count_log2 &gt; 30)

      {return $output;}
 
      $count = 1 &lt;&lt; $count_log2;

      $salt = substr($setting, 4, 8);
 
      if (strlen($salt) != 8)
 
      {return $output;}
 
      $hash = pack('H*', md5($salt . $password));
 
      do

      {

      $hash = pack('H*', md5($hash . $password));

      }
 
      while (--$count);

      $output = substr($setting, 0, 12);

      $output .= _hash_encode64($hash, 16, $itoa64);
  
      return $output;
 
      }
 
      function _hash_gensalt_private($input, &amp;$itoa64, $iteration_count_log2 = 6)
 
      {
 
      if ($iteration_count_log2 &lt; 4 || $iteration_count_log2 &gt; 31)

      {$iteration_count_log2 = 8;}
 
      $output = '$H$';
  
      $output .= $itoa64[min($iteration_count_log2 + ((PHP_VERSION &gt;= 5) ? 5 : 3), 30)];
 
      $output .= _hash_encode64($input, 6, $itoa64);
 
      return $output;
 
      }
 
      /**
 
      * Encode hash

      */

      function _hash_encode64($input, $count, &amp;$itoa64)

      {

      $output = '';
 
      $i = 0;

      do
  
      {
 
      $value = ord($input[$i++]);

      $output .= $itoa64[$value &amp; 0x3f];
 
      if ($i &lt; $count)
 
      {$value |= ord($input[$i]) &lt;&lt; 8;}
  
      $output .= $itoa64[($value &gt;&gt; 6) &amp; 0x3f];

      if ($i++ &gt;= $count)
 
      {break;}

      if ($i &lt; $count)

      {$value |= ord($input[$i]) &lt;&lt; 16;}

      $output .= $itoa64[($value &gt;&gt; 12) &amp; 0x3f];
 
      if ($i++ &gt;= $count)
  
      {break;}

      $output .= $itoa64[($value &gt;&gt; 18) &amp; 0x3f];

      }

      while ($i &lt; $count);
 
      return $output;
 
      }
 
      function phpbb_check_hash($password, $hash)

      {
 
      $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

      if (strlen($hash) == 34)
 
      {
 
      return (_hash_crypt_private($password, $hash, $itoa64) === $hash) ? true : false;

      }
 
      return (md5($password) === $hash) ? true : false;

      }
  
      //if(isset($argv[4])) $charset=$argv[4];
 
      //else $charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';

      $charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
 
      $charset_beginning = $charset{0};

      $charset_end = $charset{strlen($charset)-1};
 
      //$HASH = '$H$99i1.eNyzhGdi5/lAnKnSjU8iIABC80';

      // $SIZE = (int) $_GET['chars'];

      $HASH = $argv[1];

      $SIZE = (int) $argv[2];
 
       

      $start = time()-1;
 
      $curtotal=0;

      $total=0;

      for($i=$SIZE; $i&gt;0; $i--) $total+=pow(strlen($charset), $i);
 
      $split=ceil(($total/strlen($charset))/5);

      echo &amp;quot; *** MAX SIZE: $SIZE, cracking HASH: $HASH\r\n&amp;quot;;
 
      echo &amp;quot; *** TOTAL KEYS: $total\r\n&amp;quot;;
 
      echo &amp;quot; *** CHARSET: $charset\r\n&amp;quot;;

      for($i=1; $i&lt;=$SIZE; $i++) {
 
          $keyspace = pow(strlen($charset), $i);

          echo &amp;quot;\r\nAttempting to crack with $i characters.\r\n&amp;quot;;

          echo &amp;quot; *** Total combinations: $keyspace\r\n&amp;quot;;

       

          $key = '';

          for ($y=0; $y&lt;$i; $y++) $key .= $charset_beginning;

       

          for ($x=0; $x&lt;$keyspace+1; $x++) {

              $curtotal++;

       

              if (phpbb_check_hash($key, $HASH)) {
 
                  $time=(time()-$start);

                  echo&lt;&lt;&lt;END
 
       

      Successfully key cracked after $time seconds. The cracker searched a total
 
      of $curtotal keys out of a possible $total in $time seconds.

       

      Found the clear text of '$HASH' is '$key'.\n
 
      END;

                  exit;

              }
 
       

              if($x%$split == 0) {
 
                  $rate=ceil($curtotal/(time()-$start));
 
                  echo &amp;quot; ... $curtotal/$total ($key) [$rate Keys/second]\r\n&amp;quot;;
 
              }

       
 
              for ($y=0; $y&lt;$i; $y++) {

                  if ($key[$y] != $charset_end) {
 
                      $key[$y] = $charset{strpos($charset, $key[$y])+1};

                   

                      if ($y &gt; 0)  for ($z = 0; $z &lt; $y; $z++) $key[$z] = $charset_beginning;

                      break;
 
                  }
 
              }
 
          }
 
      }
 $time=time()-$start;

      echo&lt;&lt;&lt;END
 
      *** SORRY NO MATCHS FOUND

          Time running : $time. Keys searched : $total.\n
 
      END;

      <?