Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

php_mt_seed - PHP mt_rand() seed cracker

php_mt_seed is a PHP mt_rand() seed cracker. In the most trivial invocation mode, it finds possible seeds given the very first mt_rand() output after possible seeding with mt_srand(). With advanced invocation modes, it is also able to match multiple, non-first, and/or inexact mt_rand() outputs to possible seed values.

PHP's mt_rand() algorithm changed over the years since its introduction in PHP 3.0.6. php_mt_seed 4.0 supports 3 major revisions of the algorithm: PHP 3.0.7 to 5.2.0, PHP 5.2.1 to 7.0.x, and PHP 7.1.0+ (at least up to the latest as of this writing, which is PHP 7.2.0beta3).

php_mt_seed uses attack-optimized reimplementations of PHP's mt_rand() algorithms. It is written in C with optional SIMD intrinsics (SSE2, SSE4.1/AVX, XOP, AVX2, AVX-512, as well as MIC) and OpenMP. On a modern quad-core CPU, it is able to search the full 32-bit seed space in under a minute. On second generation Xeon Phi, it does the same in 3 seconds.

You can view the latest README file, which explains php_mt_seed use cases, provides usage examples, and includes benchmarks on a variety of systems (ranging from quad-core CPU to 16-core server and to Xeon Phi). The README file is also included in the archive below.

Download (release notes, previous release notes):

• php_mt_seed 4.0 and its signature
• php_mt_seed 3.4 and its signature

These and older versions of php_mt_seed are also available from the Openwall file archive. The source code of php_mt_seed can be browsed on GitHub or via CVSweb. (You might find the older versions and revision history useful to better understand how php_mt_seed works and what optimizations have been made.)

Follow this link for information on verifying the signatures.

Why crack mt_rand() seeds?
It is well-known that mt_rand() is a non-cryptographic PRNG and that its 32-bit seed space would be too small for cryptographic applications. Yet many PHP applications misuse mt_rand() for purposes where a CSPRNG would be needed. Thus, a use case of php_mt_seed is to demonstrate to developers and users of those applications just how very practical it is to attack mt_rand() and how vulnerable those applications are, so that the misuses of mt_rand() would decline. Specific opportunities for such demonstration include source code audits and network/system penetration tests. In the latter, the cracked seeds may allow the penetration test to proceed further into the network or system, potentially exposing other vulnerabilities there may be. Other opportunities to practice with php_mt_seed include CTFs (capture the flag competitions).

External web pages illustrating usage of php_mt_seed (including CTF writeups):

• Reddit /r/netsec discussion on php_mt_seed
• Breaking the NemucodAES Ransomware
• HITCON - Web 300 Giraffe
• ASIS CTF - Three Magic [WEB]
• Insufficient Entropy For Random Values "Survive The Deep End: PHP Security" book chapter
• EKOParty 2015 Rand DOOM ("Do you think this password recovery is safe?") Write Up (French)
• Attaques sur mt_rand - "All your tokens are belong to us": le cas d'eZ Publish (French)
  eZ Publish token reset and password prediction PoC (Python script that invokes Hashcat and php_mt_seed)
• phpcms mt_rand seed crack caused by authkey leak (Chinese)
  360 Security Geek 2017 Q2 (Chinese; PDF pages 189-192)
• PHP random number security analysis (Chinese)

Other relevant external web pages and projects:

• mt_srand and not so random numbers (2008)
• Abusing weak PRNGs in PHP applications (2010)
• Cracking Random Number Generators - Part 1, Part 2, Part 3, Part 4 (2010)
• Snowflake tool for exploiting randomness vulnerabilities by seed recovery attacks targetting the rand() and mt_rand() generators in PHP applications (2012)
  presented in I Forgot Your Password: Randomness Attacks Against PHP Applications at USENIX Security 2012
• Not So Random Numbers. Take Two focusing on PHPSESSID (2012)
  ZeroNights 2012 slides, HITB Magazine Issue 10, January 2014 (PDF pages 28-31)
• Naive implementation of mt_rand using pyopencl and pycuda (2012)
• A tiny CUDA framework for bruting PHP mt_srand(seed) and another revision of it (2012)
• notrandom() - reverse the Mersenne Twister targeting Python (2012, 2015)
• Prangster tool from the Black Hat USA 2013 presentation "Black-Box Assessment of Pseudorandom Algorithms" (2013)
• Untwister multi-threaded seed recovery tool for common PRNGs (2014, 2015)
  Untwisting the Mersenne Twister: How I killed the PRNG talk video from BSides Las Vegas 2014
• foresight is a Python library for predicting the output of random number generators (2015-2017)
• Cracking PHP rand() but not mt_rand() (2016)
  code ("two versions, one that calls the glibc rand and one that mimics the Windows rand")
• Pseudo-Random Numbers Prediction - Richard Molnar's thesis (2017)
  Introduces and compares Richard's unreleased(?) rm_toolkit against php_mt_seed and Untwister

Please consider sponsoring the 3v4l.org online PHP editor, a third-party project which was extremely helpful for development, testing, and documentation of php_mt_seed (in particular, identifying quirks of different PHP versions).

199508