爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
) T2 I. s5 z6 o: Y, p+ rOS 名称: Microsoft® Windows Server® 2008 Enterprise
" X4 c% I, r- }& @1 X% v% I9 NOS 版本: 6.0.6001 Service Pack 1 Build 6001
$ E$ v$ }$ }2 {3 ^; NOS 制造商: Microsoft Corporation
1 z: W6 E/ `; N0 P+ K* n. X+ vOS 配置: 独立服务器
) }. V' ]8 @3 ^- kOS 构件类型: Multiprocessor Free
' F3 g. E0 }2 U4 V注册的所有人: Windows 用户
' v* U8 b: W$ @! U% T* E" X系统型号: PowerEdge R620
4 c+ ?1 i5 |/ w& p, w* n系统类型: x64-based PC
0 x1 d: a3 n* _处理器: 安装了 1 个处理器。
' C" H& g7 F2 d$ B; t4 k3 z% s[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
0 O' E9 n) s( Q3 e( c  Rcat md5.txt
3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
7 a- N2 q& D+ D9 s' @/ c1 j( s& z15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
/* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
: D+ |3 _) z! v/ G# e" ~Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
. F0 R6 ^) }' c$ p9 w0 NRecovered.: 0/3 hashes, 0/3 salts
Speed/sec.: – plains, – words
( \8 `( E" U( m9 i) t, ~Progress..: 100000/100000 (100.00%)
Running…: –:–:–:–
Estimated.: –:–:–:–
7 a# p$ C4 d  W: J" w. |& z15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
Input.Mode: Mask (?d?d?d?d?d?d)
/ P8 `/ v4 O9 j  z  |. u  U( {Index…..: 0/1 (segment), 1000000 (words), 0 (bytes)
2 j! y$ q, o7 h+ k" kRecovered.: 1/3 hashes, 1/3 salts
( N. ]' J* W2 \5 DSpeed/sec.: 7.43M plains, 3.72M words
Progress..: 1000000/1000000 (100.00%)
Running…: 00:00:00:01
Estimated.: –:–:–:–
0 Z+ }& |2 `7 s- ^Input.Mode: Mask (?d?d?d?d?d?d?d)
+ V; Q) Y: \+ i  a& u, E9 qIndex…..: 0/1 (segment), 10000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
) y: T; u# _9 ^& `! t; jSpeed/sec.: 13.67M plains, 6.83M words
; b/ n6 m, A0 E* K! q5 TProgress..: 10000000/10000000 (100.00%)
" T* i' |' z& x. k, u0 w5 P0 b! XRunning…: 00:00:00:01
Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d?d)
5 l% N% H4 _  ]+ {Index…..: 0/1 (segment), 100000000 (words), 0 (bytes)
/ Y- q2 a4 f7 a' X7 L: ZRecovered.: 1/3 hashes, 1/3 salts
2 p5 a( N  {: V( [" G. QSpeed/sec.: 18.59M plains, 9.29M words
3 s+ n3 W, u% X4 XProgress..: 100000000/100000000 (100.00%)
Running…: 00:00:00:11
# Q) N4 q6 s" h( T+ k) d+ rEstimated.: –:–:–:–
865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
可以看到破解 9位3开纯数字密码需要11秒。
Input.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
Recovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
  b5 ~, c- z2 OProgress..: 10000000000/10000000000 (100.00%)
Running…: 00:00:13:07
- R0 h' q' ]% _& j. X( _$ NEstimated.: –:–:–:–
9 B* s/ V* ~  y8 x. W  y0 {而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
+ B( R! l5 n4 S/ D/ l在这里可以下载到一些字典，不过国人对这些字典貌似无视。
$ ?7 v0 k0 }( _9 ^6 `http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html