爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
OS 名称: Microsoft® Windows Server® 2008 Enterprise
3 F8 t7 l9 z" \0 `OS 版本: 6.0.6001 Service Pack 1 Build 6001
: f- z; x6 K$ }5 a7 v; e5 N! ]: POS 制造商: Microsoft Corporation
" G$ l# G  @* p( tOS 配置: 独立服务器
OS 构件类型: Multiprocessor Free
注册的所有人: Windows 用户
( I7 h& x7 P) ^- K+ ]系统型号: PowerEdge R620
% L# E9 i' _1 @# k3 w系统类型: x64-based PC
( {  Q3 q. ^: |+ X2 `" [处理器: 安装了 1 个处理器。
[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
cat md5.txt
7 _8 w/ n  l- ?' L6 H3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
# p) |8 \# F9 e/ d865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
4 m7 q; O& Q0 M6 ^5 T/ `5 `) M- Y /* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
8 u' z$ Y$ ]5 ~& B4 @+ w- Y: mInput.Mode: Mask (?d?d?d?d?d)
Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
8 v3 U* ~3 Y9 P, t. u% `" ]+ xRecovered.: 0/3 hashes, 0/3 salts
% N! D- A+ f: s0 X' s' y5 rSpeed/sec.: – plains, – words
Progress..: 100000/100000 (100.00%)
Running…: –:–:–:–
Estimated.: –:–:–:–
2 B- J$ S! F; S, h1 I+ }; {3 ?15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
7 k! j( v5 `6 U5 w9 _6 SInput.Mode: Mask (?d?d?d?d?d?d)
4 d! ]" w  K, M  T. tIndex…..: 0/1 (segment), 1000000 (words), 0 (bytes)
2 {9 T; Y6 J, `+ ERecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 7.43M plains, 3.72M words
- K. t( P6 z5 ]* _# lProgress..: 1000000/1000000 (100.00%)
Running…: 00:00:00:01
Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d)
/ o' I5 c- q7 s1 c, G- }Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
* |, F& y$ }2 X2 j: \Recovered.: 1/3 hashes, 1/3 salts
6 V, p9 Z1 `6 D( f" r3 P# FSpeed/sec.: 13.67M plains, 6.83M words
& X4 W' U3 v( h' t  BProgress..: 10000000/10000000 (100.00%)
Running…: 00:00:00:01
Estimated.: –:–:–:–
) {3 m% h, b% l6 c$ r( e, ?9 [Input.Mode: Mask (?d?d?d?d?d?d?d?d)
$ P' t/ i! @  S& p: r/ w9 ~7 YIndex…..: 0/1 (segment), 100000000 (words), 0 (bytes)
- j+ N! Q6 A5 h6 l5 Q% lRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 18.59M plains, 9.29M words
6 y* d% d  j+ M* s. L; v: WProgress..: 100000000/100000000 (100.00%)
  _" A; Q* b/ ^8 w. o) ^$ w9 pRunning…: 00:00:00:11
# @7 f" I- I7 zEstimated.: –:–:–:–
# t! i- C3 c& R# C7 K865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
# ]5 E& r# r/ A' l! b# c# ^可以看到破解 9位3开纯数字密码需要11秒。
Input.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
8 E4 k5 Q, `+ U- j; P; rIndex…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
, t% o8 d" |! N) p7 `4 i5 TRecovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
7 @8 c/ z; M2 h. P: m8 WProgress..: 10000000000/10000000000 (100.00%)
" A* Z, k( V& z( m; A" H8 KRunning…: 00:00:13:07
: n8 W1 b  q) ]" ]Estimated.: –:–:–:–
而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html