爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
5 l8 }; W2 [3 t) w# C. f- nOS 名称: Microsoft® Windows Server® 2008 Enterprise
' W7 J0 c# T- YOS 版本: 6.0.6001 Service Pack 1 Build 6001
1 R, M' H  j! \& X* FOS 制造商: Microsoft Corporation
9 }8 e  C: e6 f. s9 L  Y% oOS 配置: 独立服务器
OS 构件类型: Multiprocessor Free
注册的所有人: Windows 用户
0 i) u2 |' m, r4 m6 e系统型号: PowerEdge R620
; g. H2 W0 |5 i1 ^系统类型: x64-based PC
3 p: o# Q  {" d( ]6 g- E* W. {4 W处理器: 安装了 1 个处理器。
[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
cat md5.txt
3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
8 p4 z7 K* _7 ]2 e* i! N; V15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
. g& c0 |  Q, ^6 U& I+ s8 R1 I /* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
$ K2 w6 w3 q) j. N! ?3 i9 oIndex…..: 0/1 (segment), 100000 (words), 0 (bytes)
' d& F4 b% j/ e3 t/ S# U% `- _Recovered.: 0/3 hashes, 0/3 salts
Speed/sec.: – plains, – words
Progress..: 100000/100000 (100.00%)
Running…: –:–:–:–
Estimated.: –:–:–:–
15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
1 r! T; w8 E1 M& i6 T" cInput.Mode: Mask (?d?d?d?d?d?d)
Index…..: 0/1 (segment), 1000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 7.43M plains, 3.72M words
$ n. Y% X( O6 D8 M5 m  zProgress..: 1000000/1000000 (100.00%)
0 C+ r" T0 ?$ ]/ Z) W+ k5 RRunning…: 00:00:00:01
" |6 b: R' t8 o* C6 @Estimated.: –:–:–:–
7 y1 o8 V/ g$ d" O, dInput.Mode: Mask (?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
) o8 v% w" x! {4 d5 @, qRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 13.67M plains, 6.83M words
. M, j7 Q/ j( F0 K& a+ JProgress..: 10000000/10000000 (100.00%)
/ c8 Q( \" G$ d/ A. U1 |$ mRunning…: 00:00:00:01
Estimated.: –:–:–:–
, }3 o$ S8 t1 A$ k6 G7 cInput.Mode: Mask (?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 100000000 (words), 0 (bytes)
. h* @0 C8 i3 y" W: Q* b: KRecovered.: 1/3 hashes, 1/3 salts
1 _) U) }1 s: v. OSpeed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
3 R% ~+ r9 R3 Y* vRunning…: 00:00:00:11
Estimated.: –:–:–:–
865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
可以看到破解 9位3开纯数字密码需要11秒。
9 {) R3 |4 q" p" K& QInput.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
5 r. m' ]% c- c9 VRecovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
2 C- S( V- F( G. Q$ GProgress..: 10000000000/10000000000 (100.00%)
Running…: 00:00:13:07
; x& j$ C2 B1 H+ u" FEstimated.: –:–:–:–
而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
+ L6 {$ ^# \* zhttp://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html