爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
3 ?$ C0 V  Q$ z1 U+ r$ wOS 名称: Microsoft® Windows Server® 2008 Enterprise
OS 版本: 6.0.6001 Service Pack 1 Build 6001
OS 制造商: Microsoft Corporation
OS 配置: 独立服务器
$ ^0 C; a/ o' f5 s- L- ]OS 构件类型: Multiprocessor Free
注册的所有人: Windows 用户
8 b, {7 E& q' a. B9 A0 Y系统型号: PowerEdge R620
系统类型: x64-based PC
处理器: 安装了 1 个处理器。
[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
' f) e" q4 A$ l" v% n6 h/ ecat md5.txt
# r1 i& L/ @- b; S, p" Z! b3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
) C3 r' O& n9 U1 k* J, R" n: x865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
% A* C! e- @  ?) C15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
4 B2 a. @7 U0 s /* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
  _  w' S# f, f1 r  W! SInput.Mode: Mask (?d?d?d?d?d)
0 I% \* ~, D; |- g6 x5 v0 p( t0 \Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
5 R' o2 ]6 g( ]+ _! V2 PRecovered.: 0/3 hashes, 0/3 salts
9 e: y; p$ ~+ _* m$ p- x# NSpeed/sec.: – plains, – words
Progress..: 100000/100000 (100.00%)
Running…: –:–:–:–
6 \  q; a8 X/ w% H! t# x: cEstimated.: –:–:–:–
& ]1 \) f8 W& k! Q2 c0 q) l15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
Input.Mode: Mask (?d?d?d?d?d?d)
Index…..: 0/1 (segment), 1000000 (words), 0 (bytes)
- l% u7 \$ }; s) [) D. |0 C5 FRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 7.43M plains, 3.72M words
Progress..: 1000000/1000000 (100.00%)
% y  U* j5 P" e: l6 u0 _Running…: 00:00:00:01
5 p& e4 H8 r. h; `( p$ fEstimated.: –:–:–:–
* }5 p. w( U% @( o" m/ C3 R, R% `Input.Mode: Mask (?d?d?d?d?d?d?d)
4 b  W5 B$ |: J! h/ M5 W  f5 ZIndex…..: 0/1 (segment), 10000000 (words), 0 (bytes)
; J! n7 D6 q! |) x5 M8 R* N  kRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 13.67M plains, 6.83M words
& |3 s+ y: p& q- t) I- D. x7 WProgress..: 10000000/10000000 (100.00%)
Running…: 00:00:00:01
0 p: \5 d. a2 T# q& B/ ]Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d?d)
3 {# R. O: b1 n8 n$ P4 B6 XIndex…..: 0/1 (segment), 100000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
( H/ Z# W7 [$ `: T) K8 F8 B* ASpeed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
Running…: 00:00:00:11
' j" k" O: a) z( REstimated.: –:–:–:–
865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
7 E" r& w1 I5 h可以看到破解 9位3开纯数字密码需要11秒。
: ^: }6 |" B9 z9 T  a6 [# pInput.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
+ C2 r" Q- V2 T$ [! n8 TRecovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
Progress..: 10000000000/10000000000 (100.00%)
' v9 G- E% Q. H8 oRunning…: 00:00:13:07
. Y# B7 R- [9 B  G' N. Z6 U% gEstimated.: –:–:–:–
: d) |: i5 L( C7 x而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html