爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
4 A. p) X0 {- ]6 Y% g: @OS 名称: Microsoft® Windows Server® 2008 Enterprise
+ y: c- }/ T+ z, B$ G1 F2 z% jOS 版本: 6.0.6001 Service Pack 1 Build 6001
OS 制造商: Microsoft Corporation
OS 配置: 独立服务器
8 C7 C0 b" n3 DOS 构件类型: Multiprocessor Free
注册的所有人: Windows 用户
系统型号: PowerEdge R620
系统类型: x64-based PC
9 N9 E, \$ D! z( A( H# f9 d处理器: 安装了 1 个处理器。
1 r% T1 y' U! m" t9 N. i8 x* u[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
' X" Q3 Q; j, x9 dcat md5.txt
1 E& H% M) [" K; [3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
( j2 O8 x2 e2 i/ Q' d! ^6 q15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
+ a" U  |1 j) q7 B /* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
5 H  ?' N) R% F, _; z5 s: P6 D1 ZInput.Mode: Mask (?d?d?d?d?d)
Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
Recovered.: 0/3 hashes, 0/3 salts
5 A: b. S) r0 r. h+ _, v/ aSpeed/sec.: – plains, – words
( j( u9 e4 g  K* n$ P# zProgress..: 100000/100000 (100.00%)
Running…: –:–:–:–
Estimated.: –:–:–:–
15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
! W8 G6 b6 R2 c, s+ `7 \+ XInput.Mode: Mask (?d?d?d?d?d?d)
1 D$ ]; z# v. L0 j" q4 z- nIndex…..: 0/1 (segment), 1000000 (words), 0 (bytes)
2 H( ~: L& ?) e3 B7 h& B8 U& g( c# X9 SRecovered.: 1/3 hashes, 1/3 salts
3 e. u5 b- i' S' Z4 ySpeed/sec.: 7.43M plains, 3.72M words
8 m* S+ p2 V6 Y# @Progress..: 1000000/1000000 (100.00%)
& X9 y3 B+ M. `; j9 Z5 ^Running…: 00:00:00:01
Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d)
4 h: C3 |+ i6 \( N" G* [& P7 OIndex…..: 0/1 (segment), 10000000 (words), 0 (bytes)
- M( Y0 m2 R: r1 E( oRecovered.: 1/3 hashes, 1/3 salts
% ~4 F  }( D6 p  tSpeed/sec.: 13.67M plains, 6.83M words
' P. R; a0 q4 aProgress..: 10000000/10000000 (100.00%)
Running…: 00:00:00:01
# ?0 b4 p5 D& B  rEstimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d?d)
; ]2 a% r: |2 N/ g3 D: B% j% `+ aIndex…..: 0/1 (segment), 100000000 (words), 0 (bytes)
9 `: M/ y& h/ e$ U) [8 HRecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 18.59M plains, 9.29M words
Progress..: 100000000/100000000 (100.00%)
Running…: 00:00:00:11
Estimated.: –:–:–:–
. |0 {% C" {2 n5 J4 v9 w865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
6 c! V* V) I3 _, O可以看到破解 9位3开纯数字密码需要11秒。
1 W* L, p4 ]) _: E' @8 \" F  JInput.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
Recovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
  p, s9 c4 Q0 X5 J- U' u7 \  w; RProgress..: 10000000000/10000000000 (100.00%)
0 R! q) }% ^: J6 ARunning…: 00:00:13:07
Estimated.: –:–:–:–
而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
, U* p  i9 _% R1 q6 }: t$ J在这里可以下载到一些字典，不过国人对这些字典貌似无视。
1 \9 ^7 p$ M+ n8 _# O% hhttp://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html