爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
OS 名称: Microsoft® Windows Server® 2008 Enterprise
* n1 [# @' E& e( J% K8 E, u! B7 }OS 版本: 6.0.6001 Service Pack 1 Build 6001
# j% I; W0 D; D& K5 |OS 制造商: Microsoft Corporation
- k9 f' ?9 a& _) k7 X) POS 配置: 独立服务器
OS 构件类型: Multiprocessor Free
( ]! |& L! F& I& w# R; x: D' n注册的所有人: Windows 用户
7 R5 O+ e- {5 b" c! u- L( z系统型号: PowerEdge R620
+ K4 H3 ?# i. ^& c系统类型: x64-based PC
; Z# M) W4 z! f, N3 b' `处理器: 安装了 1 个处理器。
. Z- y; j6 X  F  O4 u3 p( K[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
' D' p1 E7 s6 n' G% Fcat md5.txt
3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
  R& V# v$ K* K; e( J865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
9 U# Q/ N; Z. N) w. V0 O  v5 \2 B15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
/* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
% D$ H+ \4 v  d$ q2 f$ EIndex…..: 0/1 (segment), 100000 (words), 0 (bytes)
" {3 H& o' C0 o  @- c3 }Recovered.: 0/3 hashes, 0/3 salts
Speed/sec.: – plains, – words
7 s1 @) _8 g% i; c, x* R3 ]  vProgress..: 100000/100000 (100.00%)
# v! I4 _( N/ I3 Y$ ^+ h5 [Running…: –:–:–:–
# k9 x. ~; m" W0 {& MEstimated.: –:–:–:–
- N$ d0 T0 C9 T7 ?2 H15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
7 H# ?% n& T5 r8 {* B4 l' w( f% @Input.Mode: Mask (?d?d?d?d?d?d)
! E  y; W5 ^+ ~2 N- `Index…..: 0/1 (segment), 1000000 (words), 0 (bytes)
. o: i$ U, e. U9 G1 }# }! bRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 7.43M plains, 3.72M words
% z7 |( Z# |/ t; o$ v; b* @Progress..: 1000000/1000000 (100.00%)
Running…: 00:00:00:01
  M7 [# l: u7 r( E9 @. R  ^" REstimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
' P1 K+ m+ C- J4 H& n; QSpeed/sec.: 13.67M plains, 6.83M words
* H' d3 _: E7 q/ EProgress..: 10000000/10000000 (100.00%)
Running…: 00:00:00:01
Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d?d)
) e/ l5 D+ w! ~+ y$ p5 R1 V; XIndex…..: 0/1 (segment), 100000000 (words), 0 (bytes)
& c* S9 w2 S% q& g" Q' ^' fRecovered.: 1/3 hashes, 1/3 salts
; [/ \* O1 @4 \Speed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
Running…: 00:00:00:11
. J# Y' b$ L/ @* b# R; q; DEstimated.: –:–:–:–
) T: C2 `) z. {& S$ O865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
8 j! T, t; s( D7 E6 u& {可以看到破解 9位3开纯数字密码需要11秒。
$ ?. R7 L0 v2 c# a4 wInput.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
: T- N* v! H7 r" q/ @0 aIndex…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
Recovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
' S" B! x2 I% j- b. w7 \$ NProgress..: 10000000000/10000000000 (100.00%)
Running…: 00:00:13:07
% f2 U' D. R1 `Estimated.: –:–:–:–
' i9 I- ^9 Y$ C% C. h- X而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
" h, Q! a- c* b) Z1 lhttp://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html