爆破、破解Disduz x 2.5 md5(md5(pass)$salt)密码加密

admin

测试环境
# J& Q" j8 }" \6 Q% a5 g; K0 SOS 名称: Microsoft® Windows Server® 2008 Enterprise
OS 版本: 6.0.6001 Service Pack 1 Build 6001
OS 制造商: Microsoft Corporation
OS 配置: 独立服务器
OS 构件类型: Multiprocessor Free
( v# C& x2 ]4 S- s) D4 j& `注册的所有人: Windows 用户
9 Z3 A: J' q" {- v9 T系统型号: PowerEdge R620
系统类型: x64-based PC
% H. ]  ]! [1 q; k7 ], s: z处理器: 安装了 1 个处理器。
; T+ Q1 E9 \/ @# J! N+ k  u7 {[01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2400
; Q* i8 p% C! j( W8 ]' hcat md5.txt
1 l, M( Z) ?9 ?- I9 b9 C3fb78e9bc0b297e3de4e77531766c37a:f29f95 /* = md5中无法查询的。*/
865a697fb9b4bd9c6737432aaff136bd:22dc87 /* = 304892415 */
1 l- M2 L& I* I9 K1 q7 ~6 l15b7a21513f24ffe97d9f9830acf51ad:07626c /* = 123456 */
) v) E4 G  M+ k2 F3 U  E /* -a 使用穷举模式 -m HASH的类型是VB DISCUZ跟DV加密是一样，?d是代表数字 穷举10个数字 */ hashcat-cli64.exe -a 3 -m 2611 md5.txt ?d?d?d?d?d?d?d?d?d?d
Input.Mode: Mask (?d?d?d?d?d)
Index…..: 0/1 (segment), 100000 (words), 0 (bytes)
& d7 B/ z' }' @Recovered.: 0/3 hashes, 0/3 salts
2 Y1 \! z) K; N" H/ C1 `Speed/sec.: – plains, – words
Progress..: 100000/100000 (100.00%)
' t% {! h- D' V. w8 rRunning…: –:–:–:–
* `; b! H, ^' JEstimated.: –:–:–:–
' n+ f$ X' @' J" m) b15b7a21513f24ffe97d9f9830acf51ad:07626c:123456
/ }6 \, G' T: \, q; ?1 m4 S) G0 uInput.Mode: Mask (?d?d?d?d?d?d)
2 P. r' U# c+ l% [6 Y7 y3 fIndex…..: 0/1 (segment), 1000000 (words), 0 (bytes)
$ p5 r' x* p) n9 G5 W0 URecovered.: 1/3 hashes, 1/3 salts
$ B# H& W, `3 w. S" `6 [2 }Speed/sec.: 7.43M plains, 3.72M words
2 m# ?" G7 {) i$ \4 S  eProgress..: 1000000/1000000 (100.00%)
Running…: 00:00:00:01
Estimated.: –:–:–:–
Input.Mode: Mask (?d?d?d?d?d?d?d)
# I9 R! o* p- u! B- g' [Index…..: 0/1 (segment), 10000000 (words), 0 (bytes)
; t) V. i/ _' r1 W, T! a7 p6 oRecovered.: 1/3 hashes, 1/3 salts
; K7 h' S. }. Z) i4 U5 i8 l. j1 E' C3 t+ TSpeed/sec.: 13.67M plains, 6.83M words
3 h% X: l* M: r6 a9 lProgress..: 10000000/10000000 (100.00%)
Running…: 00:00:00:01
% w/ T$ s. d' _! BEstimated.: –:–:–:–
6 o3 Q# H: Q+ dInput.Mode: Mask (?d?d?d?d?d?d?d?d)
7 G) `; n' d% S, aIndex…..: 0/1 (segment), 100000000 (words), 0 (bytes)
/ a  ^% X" O8 h; ]# V  K0 u# j9 URecovered.: 1/3 hashes, 1/3 salts
Speed/sec.: 18.59M plains, 9.29M words
0 O! e) k" T1 O  E; VProgress..: 100000000/100000000 (100.00%)
7 S- D9 S% r  a- Z) Q+ U2 B( RRunning…: 00:00:00:11
+ |' u- V5 v' P5 Y* `8 U$ [3 J$ R) ~Estimated.: –:–:–:–
  c8 L) T8 J8 u5 J, |865a697fb9b4bd9c6737432aaff136bd:22dc87:304892415
可以看到破解 9位3开纯数字密码需要11秒。
Input.Mode: Mask (?d?d?d?d?d?d?d?d?d?d)
Index…..: 0/1 (segment), 10000000000 (words), 0 (bytes)
: A/ X7 G, d% j6 [Recovered.: 2/3 hashes, 2/3 salts
Speed/sec.: 12.70M plains, 12.70M words
Progress..: 10000000000/10000000000 (100.00%)
: S8 f# _, m) C: N4 M  ?Running…: 00:00:13:07
Estimated.: –:–:–:–
而10个数字即需要13分钟，这样的速度如果有服务器是8核或更多，或者自己GPU强劲，会更加快，我测试只是用了一个入门级的CPU。
0 W3 F8 Z7 X9 W2 b  B在这里可以下载到一些字典，不过国人对这些字典貌似无视。
( b9 }% z( G, O% }  mhttp://blog.g0tmi1k.com/2011/06/dictionaries-wordlists.html