爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
OS 名称: Microsoft® Windows Server® 2008 Enterprise
  U8 U( C5 F6 e% d, r+ @. iOS 版本: 6.0.6001 Service Pack 1 Build 6001
OS 制造商: Microsoft Corporation
8 r3 I6 x2 @4 L2 u7 `* a. Q) KOS 配置: 独立服务器
OS 构件类型: Multiprocessor Free
- \/ l; e! f9 q) N1 q注册的所有人: Windows 用户
6 y# `3 f; @, W3 L( o系统型号: PowerEdge R620
系统类型: x64-based PC
' U6 d& {" z! M7 Y/ p: {处理器: 安装了 1 个处理器。
9 F9 S& _8 U, Y5 y% N9 Y7 L8 G[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
# l' h8 \. V: x) p7 n. v' S# I& Zcat md5.txt
" b: d* N% K9 x! ^' t6 Q3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
/* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
! z9 s7 D+ }) J' @# AIndex…..: 0/1 (segment), 100000 (words), 0 (bytes)
Recovered.: 0/3 hashes, 0/3 salts
Speed/sec.: – plains, – words
/ Q& D4 k$ U* s- o3 x! F7 gProgress..: 100000/100000 (100.00%)
( Z* {1 }6 b  D/ \  D; aRunning…: –:–:–:–
Estimated.: –:–:–:–
15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
/ g: l9 y9 D3 ?5 L  IInput.Mode: Mask (?d?d?d?d?d?d)
Index…..: 0/1 (segment), 1000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
3 P0 _  |. T; t6 A6 hSpeed/sec.: 7.43M plains, 3.72M words
Progress..: 1000000/1000000 (100.00%)
# s# }) X- f8 G9 Q& fRunning…: 00:00:00:01
Estimated.: –:–:–:–
% ]* |9 J5 u9 i% qInput.Mode: Mask (?d?d?d?d?d?d?d)
) P4 ^' l. L: ^% V  a$ H: `4 U1 UIndex…..: 0/1 (segment), 10000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
2 B' l/ y7 `" n/ ESpeed/sec.: 13.67M plains, 6.83M words
Progress..: 10000000/10000000 (100.00%)
% y8 T4 |0 T7 _& s# g( A+ y4 z5 PRunning…: 00:00:00:01
Estimated.: –:–:–:–
( H/ I0 P7 H2 e3 n+ n8 vInput.Mode: Mask (?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 100000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
# t( y: F; @5 K+ O0 `; PSpeed/sec.: 18.59M plains, 9.29M words
; ~( d& _; ?+ C5 t! ^& p0 D$ PProgress..: 100000000/100000000 (100.00%)
Running…: 00:00:00:11
( S  Q5 [) A1 t* d# T! IEstimated.: –:–:–:–
865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
可以看到破解 9位3开纯数字密码需要11秒。
Input.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
! U# x6 [6 s/ d7 q* l2 I  c7 K4 OIndex…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
, u. b2 \3 o5 K; _) t! k8 tRecovered.: 2/3 hashes, 2/3 salts
! Q( N  g5 H1 L  ]( U+ D4 qSpeed/sec.: 12.70M plains, 12.70M words
Progress..: 10000000000/10000000000 (100.00%)
& g: O. ?. W3 h- a6 a' WRunning…: 00:00:13:07
, R4 ?& T* Y: ~& BEstimated.: –:–:–:–
- H7 j$ U) z6 W% Z! }+ M+ I而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html