爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
OS 名称: Microsoft® Windows Server® 2008 Enterprise
/ c. P0 O6 q# N. H  GOS 版本: 6.0.6001 Service Pack 1 Build 6001
* l; C( n' H* K- U1 `OS 制造商: Microsoft Corporation
OS 配置: 独立服务器
* m9 x3 d( D# X9 d3 M9 M' mOS 构件类型: Multiprocessor Free
注册的所有人: Windows 用户
8 @7 d7 z0 z. [系统型号: PowerEdge R620
7 k- D' t4 d+ N# v, t& r系统类型: x64-based PC
处理器: 安装了 1 个处理器。
3 u2 ]" p7 ?9 p1 Q[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
2 Q) M. R' B/ \9 G6 ~/ k6 F" `cat md5.txt
" q+ ^$ H. n$ g" F; W% a$ A3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
* ^$ f+ Z/ y5 a$ Q0 M; k7 o15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
% n1 U. s3 V3 ]" C* b; u6 k& E7 v /* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
/ T( j3 S* s: X7 q4 _' O( cInput.Mode: Mask (?d?d?d?d?d)
3 Z  a# S) X4 c  v1 G3 IIndex…..: 0/1 (segment), 100000 (words), 0 (bytes)
" l+ s- J2 C% f$ Y: e% t9 P0 tRecovered.: 0/3 hashes, 0/3 salts
Speed/sec.: – plains, – words
0 w; u) r6 E) F: y3 }6 j/ _Progress..: 100000/100000 (100.00%)
8 b) {* c: m' ?# Q' G/ lRunning…: –:–:–:–
8 I# o0 ]& \4 u1 s; [Estimated.: –:–:–:–
3 P: @3 I0 H4 m/ M$ d$ H15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
" K3 v7 n+ _5 y4 bInput.Mode: Mask (?d?d?d?d?d?d)
; b0 O; u# }' Q3 L% v4 @Index…..: 0/1 (segment), 1000000 (words), 0 (bytes)
, p9 n( k0 S- Y) h& `$ v3 K/ oRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 7.43M plains, 3.72M words
Progress..: 1000000/1000000 (100.00%)
, f, b6 n; C1 y. K6 n* q, DRunning…: 00:00:00:01
9 {6 r' h4 q  |2 c% z( ]Estimated.: –:–:–:–
/ V: F7 E8 O, Z9 W7 l" z8 \Input.Mode: Mask (?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 13.67M plains, 6.83M words
Progress..: 10000000/10000000 (100.00%)
  F3 W) [0 z$ l- N3 P5 ORunning…: 00:00:00:01
Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d?d)
# O0 n: H. z- dIndex…..: 0/1 (segment), 100000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
& T) P8 Y) b7 L1 n- W, Y8 lSpeed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
& i% j) J  p* y1 I( @! ZRunning…: 00:00:00:11
Estimated.: –:–:–:–
# Y& g- n7 Z+ R8 z865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
可以看到破解 9位3开纯数字密码需要11秒。
Input.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
7 T) J. u0 x' A# WIndex…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
Recovered.: 2/3 hashes, 2/3 salts
/ G3 t/ `" g/ ^, @2 i9 V' m  mSpeed/sec.: 12.70M plains, 12.70M words
) z9 ]) ?, `& h' u6 q- }; XProgress..: 10000000000/10000000000 (100.00%)
Running…: 00:00:13:07
8 z' u' v# T8 s8 l; u# pEstimated.: –:–:–:–
而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
6 P1 q- }7 u( Y. Y" k$ L% j; Ghttp://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html