爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
OS 名称: Microsoft® Windows Server® 2008 Enterprise
$ A, ^8 P: @, T) Q' `OS 版本: 6.0.6001 Service Pack 1 Build 6001
; }" Y7 ]  c+ s3 nOS 制造商: Microsoft Corporation
* {8 O8 L5 C, Y* S4 ^  j/ POS 配置: 独立服务器
OS 构件类型: Multiprocessor Free
9 _& l# l8 j! z& y4 Y注册的所有人: Windows 用户
系统型号: PowerEdge R620
系统类型: x64-based PC
! L6 G; Q4 q$ N0 E& n$ O$ k处理器: 安装了 1 个处理器。
' W; Z/ Q! k- l; [: A8 S[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
  N7 B  H6 z% hcat md5.txt
" E: W) Y3 Z) t5 ~# e: @3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
5 w0 ?9 P2 w6 r$ K) J$ a865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
" e- _3 x3 I# t5 @1 d15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
: @' h4 {1 `8 m  y4 t+ D' [ /* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
9 Y0 h( v" X) `+ C! A  S% Q7 i' `Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
Recovered.: 0/3 hashes, 0/3 salts
% B" m3 V* Y8 U: h/ X# PSpeed/sec.: – plains, – words
7 t2 T5 j0 O0 a. U2 ^# nProgress..: 100000/100000 (100.00%)
& ~& }7 Y, f( u+ J& Q2 oRunning…: –:–:–:–
( n% r/ e6 b3 [& FEstimated.: –:–:–:–
/ o( a% i+ [. l( R15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
. n9 Q9 \  d3 BInput.Mode: Mask (?d?d?d?d?d?d)
& z' |1 s" N6 p! i2 z- c' AIndex…..: 0/1 (segment), 1000000 (words), 0 (bytes)
5 Y; J0 S/ ]; `/ R# B+ l& fRecovered.: 1/3 hashes, 1/3 salts
0 q) m- }+ F0 z- z: E3 O. C2 e( nSpeed/sec.: 7.43M plains, 3.72M words
% f/ h7 b. _- C3 S( e( P, WProgress..: 1000000/1000000 (100.00%)
- d  T; u  w$ ^  n, URunning…: 00:00:00:01
Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
/ C) ]( R/ w  T9 mSpeed/sec.: 13.67M plains, 6.83M words
Progress..: 10000000/10000000 (100.00%)
9 H- J3 k/ W) L8 K# a& ERunning…: 00:00:00:01
Estimated.: –:–:–:–
: I# M5 P/ B4 o2 N  rInput.Mode: Mask (?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 100000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
7 R* S0 q2 ?' j9 ]( a+ }; oSpeed/sec.: 18.59M plains, 9.29M words
+ A8 S3 p2 y. U4 H0 ]) w% b: sProgress..: 100000000/100000000 (100.00%)
Running…: 00:00:00:11
/ r& T  ?# G% D# m+ QEstimated.: –:–:–:–
( w4 }0 E1 a- b( U( k  x; g! J865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
可以看到破解 9位3开纯数字密码需要11秒。
+ G/ y; V: a8 i) i& r, R  ^Input.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
) ?2 i. \8 [7 P0 j2 `! OIndex…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
Recovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
% r1 P; F: Z  R. WProgress..: 10000000000/10000000000 (100.00%)
6 p, ^; e  C# P- ]  u1 LRunning…: 00:00:13:07
Estimated.: –:–:–:–
3 I. @, \& m" a而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
在这里可以下载到一些字典，不过国人对这些字典貌似无视。
http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html