爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
$ ~  ]& i  z! _( ]* K6 I. g  rOS 名称: Microsoft® Windows Server® 2008 Enterprise
OS 版本: 6.0.6001 Service Pack 1 Build 6001
OS 制造商: Microsoft Corporation
OS 配置: 独立服务器
OS 构件类型: Multiprocessor Free
8 z; U5 G2 r5 c/ Z3 ]# n5 `注册的所有人: Windows 用户
系统型号: PowerEdge R620
/ c( A/ ~, ~2 h/ B' J$ Y& U系统类型: x64-based PC
处理器: 安装了 1 个处理器。
  t, [3 ]& ]' M. r[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
% n7 _5 [1 K! f- a  Ncat md5.txt
3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
( o0 j  D4 x4 y  @865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
$ Z0 }5 I, q1 [4 T# v9 Y& W15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
/* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
- P% c2 X4 K3 J2 z9 _Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
4 o2 }+ M% o( R& ~* z# j$ A  uRecovered.: 0/3 hashes, 0/3 salts
Speed/sec.: – plains, – words
Progress..: 100000/100000 (100.00%)
; O% i2 W2 a& TRunning…: –:–:–:–
Estimated.: –:–:–:–
15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
# _6 {& F7 i1 n3 G( r5 }Input.Mode: Mask (?d?d?d?d?d?d)
: X& j& r% d; {6 W% ^2 }: E1 XIndex…..: 0/1 (segment), 1000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
& r# E3 t0 o$ `Speed/sec.: 7.43M plains, 3.72M words
$ h3 h' s1 t) u/ N/ o; m+ m% K) l1 I8 LProgress..: 1000000/1000000 (100.00%)
# w% {0 G6 y- h" o& n7 rRunning…: 00:00:00:01
, Z9 P, S3 ~  K/ P5 kEstimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d)
! t, z: t( ?4 Y, oIndex…..: 0/1 (segment), 10000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 13.67M plains, 6.83M words
Progress..: 10000000/10000000 (100.00%)
% E8 j" J# f4 g% K( p5 h  jRunning…: 00:00:00:01
% |) k- n1 ^) {Estimated.: –:–:–:–
  i2 [2 L  ~2 \4 l1 f) CInput.Mode: Mask (?d?d?d?d?d?d?d?d)
9 k1 f$ w; u2 u0 A, }7 m# iIndex…..: 0/1 (segment), 100000000 (words), 0 (bytes)
1 X  n) j! i8 v3 cRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
Running…: 00:00:00:11
Estimated.: –:–:–:–
865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
1 _7 L9 ?( V( L4 b1 k1 @5 s" h) `可以看到破解 9位3开纯数字密码需要11秒。
/ |6 f7 X* O% y# P$ x/ LInput.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
8 o& w$ v; }6 v( lRecovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
Progress..: 10000000000/10000000000 (100.00%)
Running…: 00:00:13:07
Estimated.: –:–:–:–
7 [( b- f: l$ B, i而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
6 x6 r0 `3 f# I' E3 h$ U+ Rhttp://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html