爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
OS 名称: Microsoft® Windows Server® 2008 Enterprise
, q7 B" ~. w7 M$ i& D" E* ^OS 版本: 6.0.6001 Service Pack 1 Build 6001
OS 制造商: Microsoft Corporation
OS 配置: 独立服务器
  b* u/ a2 r9 J- d( h* JOS 构件类型: Multiprocessor Free
( s# t8 c. r: [! A6 L. E注册的所有人: Windows 用户
0 U% j- ]! ^8 x2 `1 n% G" O系统型号: PowerEdge R620
系统类型: x64-based PC
; t" q/ h9 u' w7 P( r+ G处理器: 安装了 1 个处理器。
5 C) l: s, a: e( e- X: j! T: x- Y: p8 G[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
5 k2 ^' _1 n8 i9 G; q  l$ S! ucat md5.txt
3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
& g5 V3 R/ c  v. E. x5 d8 s865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
/* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
" k) L- t* R' e2 EIndex…..: 0/1 (segment), 100000 (words), 0 (bytes)
* I1 h. X- G' ^; D0 J$ |9 o0 a9 sRecovered.: 0/3 hashes, 0/3 salts
Speed/sec.: – plains, – words
Progress..: 100000/100000 (100.00%)
' ^9 S, h1 I9 v+ H- gRunning…: –:–:–:–
5 v) ?4 ?- I8 p& T5 eEstimated.: –:–:–:–
6 Z8 |" o: h/ k* [( ~15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
! S: T: S6 N: W! tInput.Mode: Mask (?d?d?d?d?d?d)
( \1 p7 a, c0 jIndex…..: 0/1 (segment), 1000000 (words), 0 (bytes)
( f5 F8 {1 i; `# TRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 7.43M plains, 3.72M words
Progress..: 1000000/1000000 (100.00%)
8 g1 Z! g& I: ^& KRunning…: 00:00:00:01
- b1 w0 D. R3 J, DEstimated.: –:–:–:–
* ^2 U# B1 Q- _; q7 R" h1 _Input.Mode: Mask (?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
6 M& Y& j" _: X; s4 ~1 }0 }Recovered.: 1/3 hashes, 1/3 salts
9 W/ y; k7 P# h5 O$ wSpeed/sec.: 13.67M plains, 6.83M words
Progress..: 10000000/10000000 (100.00%)
9 y. p, [& y* V% C$ ^Running…: 00:00:00:01
* D& S4 W( {! \/ N$ e  sEstimated.: –:–:–:–
5 E$ _: @7 \) ]8 a8 k# yInput.Mode: Mask (?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 100000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
; [# L2 \; v9 k" ^- D5 OSpeed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
' K3 `; @( l" [  l4 X3 zRunning…: 00:00:00:11
Estimated.: –:–:–:–
/ W- A2 m9 I9 p865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
可以看到破解 9位3开纯数字密码需要11秒。
9 F+ D: |: w( |$ vInput.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
Recovered.: 2/3 hashes, 2/3 salts
: R# z& |% f# b5 O, kSpeed/sec.: 12.70M plains, 12.70M words
& Y! l0 i4 b! @: ^2 L* t8 aProgress..: 10000000000/10000000000 (100.00%)
1 s+ h+ C( a5 X9 ARunning…: 00:00:13:07
Estimated.: –:–:–:–
而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
7 j4 [! _" `9 \5 v- hhttp://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html