OK, having had a good play the following options are possible with Parallels:

1. From the Recovery Partition on your machine, however this only works from the current one, not any other attached ones, so if you are booted into ML, you can only use the ML recovery partition - so no go for Lion
2. From original Media, in this case an official USB stick as it was not available on DVD, I didn't have one, so no good for me (note that hand made ones will not work, neither will if you created a bootable partition
3. From a Disk Image file. As with option 2. above, creating a bootable DVD/USB Stick/partition on an drive etc will not work if you have extracted the image file to create one. You need the actual DMG file. If you have the original App Store download, the easiest way to get this is is to rick click and Show Package Contents, then find the InstallESD.dmg file and make a copy of it.

Using the file from method 3. will allow you to use the new VM Wizard to create the Lion VM

The hdiutil command combined with a bit of bash scripting can accomplish what you're looking for. You'll need a plain text file with each password on a separate line, ending with a blank line.

1. Copy and paste this into a text file:

   #!/bin/bash
   
   while read line
   do
       echo -n "$line" | hdiutil attach -quiet -stdinpass "$1"
       if [ $? -eq 0 ]; then
           echo "Password is $line"
           break
       fi
   done < "$2"
   

2. Save it and make it executable by running chmod +x /path/to/scriptfile in Terminal.

3. In Terminal, run /path/to/scriptfile /path/to/image.dmg /path/to/passwords.txt.
   • It will run until it successfully mounts the disk image, and will output the password that worked. In my tests, it took 1.3-1.6 seconds per password, so 3000 passwords may take around an hour, depending on your system (although it could be sooner depending on where the password is in the file).

That should do the trick. If you're curious how and why it works, read on.

Explanation

While loop

    while read line
    do
    […]
    done < "$2"

This loops over each line in the password file (which is fed in via the < "$2" part) and executes the stuff between do and done each time it loops. $2 is a special variable in Bash that represents the second argument passed to the script (i.e. if you ran ./foo bar blah, $2 would be blah). It's enclosed in quotes in case there are any spaces or other characters in the name that could cause problems for Bash.

Mounting the image

hdiutil attach -quiet -stdinpass "$1"`

This is the command to actually mount the disk image (which we get from the command line arguments via the $1 variable, just like the password file). The -quiet flag means don't print any output (just to keep things tidy), and -stdinpass means get the password from the command line, not the usual OS X password dialog.

echo -n "$line"

The echo command simply repeats the input it's given, which in this case is an individual line from the password file, from the $line variable (which is again quoted in case the passwords contain special characters). The -n flag is the final piece of this puzzle, it prevents echo from repeating the newline character, which would be included in the password (and thus prevent even the correct password from working).

We use echo with a "pipe" (|) to send hdiutil the password. A pipe sends the output of the preceding command (echo) to the command after the pipe (hdiutil). This way rather than asking us for the password, hdiutil simply takes the text we read from the file.

Checking if the password was successful

if [ $? -eq 0 ]

This checks if the previous command was successful, by checking its exit code. The $? is another special variable that stores the exit code of the previous operation.

If the exit code is 0 (no errors), then we know that the password worked, and the if statement runs these lines:

    echo "Password is $line"
    break

This displays a simple message telling the user what the successful password is, then the break command exits the while loop and ends the program. We do this because the script would otherwise continue until it's checked every password in the file.

Combining all these pieces together gives you a convenient way of automating an otherwise long and painful task.