zoukankan      html  css  js  c++  java
  • hashcat的学习

     

    简介

    Hashcat是世界上最快的密码破解程序,是一个支持多平台、多算法的开源的分布式工具。

    官方:https://hashcat.net/hashcat/

    Github:https://github.com/hashcat/hashcat

    安装

    macOS

     
    Bash
    # 安装hashcat
    brew install hashcat
    
    # 查看版本
    hashcat --version

    Linux

    Kali Linux内置Hashcat,在Deepin Linux和Ubuntu Linux下可以直接使用APT来安装:

     
    Bash
    apt update && apt install hashcat
    
    # 查看版本
    hashcat --version

    也可以手动解压运行二进制文件 https://github.com/hashcat/hashcat/releases 下载最新版压缩包:

     
    Bash
    # 解压
    tar zxvf hashcat-5.1.0.7z
    cd hashcat-5.1.0
    
    # 根据自己的平台执行对应的二进制文件
    ./hashcat64.bin
    ./hashcat32.bin

    Windows

    https://github.com/hashcat/hashcat/releases 下载最新版压缩包,解压根据自己的平台运行hashcat64.exe或者hashcat32.exe

    常用参数

    -m 破解hash类型

    指定要破解的hash类型,后面跟hash类型对应的数字,具体类型详见下表:

     
    Bash
    - [ Hash modes ] -
    
          # | Name                                             | Category
      ======+==================================================+======================================
        900 | MD4                                              | Raw Hash
          0 | MD5                                              | Raw Hash
       5100 | Half MD5                                         | Raw Hash
        100 | SHA1                                             | Raw Hash
       1300 | SHA2-224                                         | Raw Hash
       1400 | SHA2-256                                         | Raw Hash
      10800 | SHA2-384                                         | Raw Hash
       1700 | SHA2-512                                         | Raw Hash
      17300 | SHA3-224                                         | Raw Hash
      17400 | SHA3-256                                         | Raw Hash
      17500 | SHA3-384                                         | Raw Hash
      17600 | SHA3-512                                         | Raw Hash
      17700 | Keccak-224                                       | Raw Hash
      17800 | Keccak-256                                       | Raw Hash
      17900 | Keccak-384                                       | Raw Hash
      18000 | Keccak-512                                       | Raw Hash
        600 | BLAKE2b-512                                      | Raw Hash
      10100 | SipHash                                          | Raw Hash
       6000 | RIPEMD-160                                       | Raw Hash
       6100 | Whirlpool                                        | Raw Hash
       6900 | GOST R 34.11-94                                  | Raw Hash
      11700 | GOST R 34.11-2012 (Streebog) 256-bit, big-endian | Raw Hash
      11800 | GOST R 34.11-2012 (Streebog) 512-bit, big-endian | Raw Hash
         10 | md5($pass.$salt)                                 | Raw Hash, Salted and/or Iterated
         20 | md5($salt.$pass)                                 | Raw Hash, Salted and/or Iterated
         30 | md5(utf16le($pass).$salt)                        | Raw Hash, Salted and/or Iterated
         40 | md5($salt.utf16le($pass))                        | Raw Hash, Salted and/or Iterated
       3800 | md5($salt.$pass.$salt)                           | Raw Hash, Salted and/or Iterated
       3710 | md5($salt.md5($pass))                            | Raw Hash, Salted and/or Iterated
       4010 | md5($salt.md5($salt.$pass))                      | Raw Hash, Salted and/or Iterated
       4110 | md5($salt.md5($pass.$salt))                      | Raw Hash, Salted and/or Iterated
       2600 | md5(md5($pass))                                  | Raw Hash, Salted and/or Iterated
       3910 | md5(md5($pass).md5($salt))                       | Raw Hash, Salted and/or Iterated
       4300 | md5(strtoupper(md5($pass)))                      | Raw Hash, Salted and/or Iterated
       4400 | md5(sha1($pass))                                 | Raw Hash, Salted and/or Iterated
        110 | sha1($pass.$salt)                                | Raw Hash, Salted and/or Iterated
        120 | sha1($salt.$pass)                                | Raw Hash, Salted and/or Iterated
        130 | sha1(utf16le($pass).$salt)                       | Raw Hash, Salted and/or Iterated
        140 | sha1($salt.utf16le($pass))                       | Raw Hash, Salted and/or Iterated
       4500 | sha1(sha1($pass))                                | Raw Hash, Salted and/or Iterated
       4520 | sha1($salt.sha1($pass))                          | Raw Hash, Salted and/or Iterated
       4700 | sha1(md5($pass))                                 | Raw Hash, Salted and/or Iterated
       4900 | sha1($salt.$pass.$salt)                          | Raw Hash, Salted and/or Iterated
      14400 | sha1(CX)                                         | Raw Hash, Salted and/or Iterated
       1410 | sha256($pass.$salt)                              | Raw Hash, Salted and/or Iterated
       1420 | sha256($salt.$pass)                              | Raw Hash, Salted and/or Iterated
       1430 | sha256(utf16le($pass).$salt)                     | Raw Hash, Salted and/or Iterated
       1440 | sha256($salt.utf16le($pass))                     | Raw Hash, Salted and/or Iterated
       1710 | sha512($pass.$salt)                              | Raw Hash, Salted and/or Iterated
       1720 | sha512($salt.$pass)                              | Raw Hash, Salted and/or Iterated
       1730 | sha512(utf16le($pass).$salt)                     | Raw Hash, Salted and/or Iterated
       1740 | sha512($salt.utf16le($pass))                     | Raw Hash, Salted and/or Iterated
         50 | HMAC-MD5 (key = $pass)                           | Raw Hash, Authenticated
         60 | HMAC-MD5 (key = $salt)                           | Raw Hash, Authenticated
        150 | HMAC-SHA1 (key = $pass)                          | Raw Hash, Authenticated
        160 | HMAC-SHA1 (key = $salt)                          | Raw Hash, Authenticated
       1450 | HMAC-SHA256 (key = $pass)                        | Raw Hash, Authenticated
       1460 | HMAC-SHA256 (key = $salt)                        | Raw Hash, Authenticated
       1750 | HMAC-SHA512 (key = $pass)                        | Raw Hash, Authenticated
       1760 | HMAC-SHA512 (key = $salt)                        | Raw Hash, Authenticated
      11750 | HMAC-Streebog-256 (key = $pass), big-endian      | Raw Hash, Authenticated
      11760 | HMAC-Streebog-256 (key = $salt), big-endian      | Raw Hash, Authenticated
      11850 | HMAC-Streebog-512 (key = $pass), big-endian      | Raw Hash, Authenticated
      11860 | HMAC-Streebog-512 (key = $salt), big-endian      | Raw Hash, Authenticated
      14000 | DES (PT = $salt, key = $pass)                    | Raw Cipher, Known-Plaintext attack
      14100 | 3DES (PT = $salt, key = $pass)                   | Raw Cipher, Known-Plaintext attack
      14900 | Skip32 (PT = $salt, key = $pass)                 | Raw Cipher, Known-Plaintext attack
      15400 | ChaCha20                                         | Raw Cipher, Known-Plaintext attack
        400 | phpass                                           | Generic KDF
       8900 | scrypt                                           | Generic KDF
      11900 | PBKDF2-HMAC-MD5                                  | Generic KDF
      12000 | PBKDF2-HMAC-SHA1                                 | Generic KDF
      10900 | PBKDF2-HMAC-SHA256                               | Generic KDF
      12100 | PBKDF2-HMAC-SHA512                               | Generic KDF
         23 | Skype                                            | Network Protocols
       2500 | WPA-EAPOL-PBKDF2                                 | Network Protocols
       2501 | WPA-EAPOL-PMK                                    | Network Protocols
      16800 | WPA-PMKID-PBKDF2                                 | Network Protocols
      16801 | WPA-PMKID-PMK                                    | Network Protocols
       4800 | iSCSI CHAP authentication, MD5(CHAP)             | Network Protocols
       5300 | IKE-PSK MD5                                      | Network Protocols
       5400 | IKE-PSK SHA1                                     | Network Protocols
       5500 | NetNTLMv1                                        | Network Protocols
       5500 | NetNTLMv1+ESS                                    | Network Protocols
       5600 | NetNTLMv2                                        | Network Protocols
       7300 | IPMI2 RAKP HMAC-SHA1                             | Network Protocols
       7500 | Kerberos 5 AS-REQ Pre-Auth etype 23              | Network Protocols
       8300 | DNSSEC (NSEC3)                                   | Network Protocols
      10200 | CRAM-MD5                                         | Network Protocols
      11100 | PostgreSQL CRAM (MD5)                            | Network Protocols
      11200 | MySQL CRAM (SHA1)                                | Network Protocols
      11400 | SIP digest authentication (MD5)                  | Network Protocols
      13100 | Kerberos 5 TGS-REP etype 23                      | Network Protocols
      16100 | TACACS+                                          | Network Protocols
      16500 | JWT (JSON Web Token)                             | Network Protocols
      18200 | Kerberos 5 AS-REP etype 23                       | Network Protocols
        121 | SMF (Simple Machines Forum) > v1.1               | Forums, CMS, E-Commerce, Frameworks
        400 | phpBB3 (MD5)                                     | Forums, CMS, E-Commerce, Frameworks
       2611 | vBulletin < v3.8.5                               | Forums, CMS, E-Commerce, Frameworks
       2711 | vBulletin >= v3.8.5                              | Forums, CMS, E-Commerce, Frameworks
       2811 | MyBB 1.2+                                        | Forums, CMS, E-Commerce, Frameworks
       2811 | IPB2+ (Invision Power Board)                     | Forums, CMS, E-Commerce, Frameworks
       8400 | WBB3 (Woltlab Burning Board)                     | Forums, CMS, E-Commerce, Frameworks
         11 | Joomla < 2.5.18                                  | Forums, CMS, E-Commerce, Frameworks
        400 | Joomla >= 2.5.18 (MD5)                           | Forums, CMS, E-Commerce, Frameworks
        400 | WordPress (MD5)                                  | Forums, CMS, E-Commerce, Frameworks
       2612 | PHPS                                             | Forums, CMS, E-Commerce, Frameworks
       7900 | Drupal7                                          | Forums, CMS, E-Commerce, Frameworks
         21 | osCommerce                                       | Forums, CMS, E-Commerce, Frameworks
         21 | xt:Commerce                                      | Forums, CMS, E-Commerce, Frameworks
      11000 | PrestaShop                                       | Forums, CMS, E-Commerce, Frameworks
        124 | Django (SHA-1)                                   | Forums, CMS, E-Commerce, Frameworks
      10000 | Django (PBKDF2-SHA256)                           | Forums, CMS, E-Commerce, Frameworks
      16000 | Tripcode                                         | Forums, CMS, E-Commerce, Frameworks
       3711 | MediaWiki B type                                 | Forums, CMS, E-Commerce, Frameworks
      13900 | OpenCart                                         | Forums, CMS, E-Commerce, Frameworks
       4521 | Redmine                                          | Forums, CMS, E-Commerce, Frameworks
       4522 | PunBB                                            | Forums, CMS, E-Commerce, Frameworks
      12001 | Atlassian (PBKDF2-HMAC-SHA1)                     | Forums, CMS, E-Commerce, Frameworks
         12 | PostgreSQL                                       | Database Server
        131 | MSSQL (2000)                                     | Database Server
        132 | MSSQL (2005)                                     | Database Server
       1731 | MSSQL (2012, 2014)                               | Database Server
        200 | MySQL323                                         | Database Server
        300 | MySQL4.1/MySQL5                                  | Database Server
       3100 | Oracle H: Type (Oracle 7+)                       | Database Server
        112 | Oracle S: Type (Oracle 11+)                      | Database Server
      12300 | Oracle T: Type (Oracle 12+)                      | Database Server
       8000 | Sybase ASE                                       | Database Server
        141 | Episerver 6.x < .NET 4                           | HTTP, SMTP, LDAP Server
       1441 | Episerver 6.x >= .NET 4                          | HTTP, SMTP, LDAP Server
       1600 | Apache $apr1$ MD5, md5apr1, MD5 (APR)            | HTTP, SMTP, LDAP Server
      12600 | ColdFusion 10+                                   | HTTP, SMTP, LDAP Server
       1421 | hMailServer                                      | HTTP, SMTP, LDAP Server
        101 | nsldap, SHA-1(Base64), Netscape LDAP SHA         | HTTP, SMTP, LDAP Server
        111 | nsldaps, SSHA-1(Base64), Netscape LDAP SSHA      | HTTP, SMTP, LDAP Server
       1411 | SSHA-256(Base64), LDAP {SSHA256}                 | HTTP, SMTP, LDAP Server
       1711 | SSHA-512(Base64), LDAP {SSHA512}                 | HTTP, SMTP, LDAP Server
      16400 | CRAM-MD5 Dovecot                                 | HTTP, SMTP, LDAP Server
      15000 | FileZilla Server >= 0.9.55                       | FTP Server
      11500 | CRC32                                            | Checksums
       3000 | LM                                               | Operating Systems
       1000 | NTLM                                             | Operating Systems
       1100 | Domain Cached Credentials (DCC), MS Cache        | Operating Systems
       2100 | Domain Cached Credentials 2 (DCC2), MS Cache 2   | Operating Systems
      15300 | DPAPI masterkey file v1                          | Operating Systems
      15900 | DPAPI masterkey file v2                          | Operating Systems
      12800 | MS-AzureSync  PBKDF2-HMAC-SHA256                 | Operating Systems
       1500 | descrypt, DES (Unix), Traditional DES            | Operating Systems
      12400 | BSDi Crypt, Extended DES                         | Operating Systems
        500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)        | Operating Systems
       3200 | bcrypt $2*$, Blowfish (Unix)                     | Operating Systems
       7400 | sha256crypt $5$, SHA256 (Unix)                   | Operating Systems
       1800 | sha512crypt $6$, SHA512 (Unix)                   | Operating Systems
        122 | macOS v10.4, MacOS v10.5, MacOS v10.6            | Operating Systems
       1722 | macOS v10.7                                      | Operating Systems
       7100 | macOS v10.8+ (PBKDF2-SHA512)                     | Operating Systems
       6300 | AIX {smd5}                                       | Operating Systems
       6700 | AIX {ssha1}                                      | Operating Systems
       6400 | AIX {ssha256}                                    | Operating Systems
       6500 | AIX {ssha512}                                    | Operating Systems
       2400 | Cisco-PIX MD5                                    | Operating Systems
       2410 | Cisco-ASA MD5                                    | Operating Systems
        500 | Cisco-IOS $1$ (MD5)                              | Operating Systems
       5700 | Cisco-IOS type 4 (SHA256)                        | Operating Systems
       9200 | Cisco-IOS $8$ (PBKDF2-SHA256)                    | Operating Systems
       9300 | Cisco-IOS $9$ (scrypt)                           | Operating Systems
         22 | Juniper NetScreen/SSG (ScreenOS)                 | Operating Systems
        501 | Juniper IVE                                      | Operating Systems
      15100 | Juniper/NetBSD sha1crypt                         | Operating Systems
       7000 | FortiGate (FortiOS)                              | Operating Systems
       5800 | Samsung Android Password/PIN                     | Operating Systems
      13800 | Windows Phone 8+ PIN/password                    | Operating Systems
       8100 | Citrix NetScaler                                 | Operating Systems
       8500 | RACF                                             | Operating Systems
       7200 | GRUB 2                                           | Operating Systems
       9900 | Radmin2                                          | Operating Systems
        125 | ArubaOS                                          | Operating Systems
       7700 | SAP CODVN B (BCODE)                              | Enterprise Application Software (EAS)
       7701 | SAP CODVN B (BCODE) via RFC_READ_TABLE           | Enterprise Application Software (EAS)
       7800 | SAP CODVN F/G (PASSCODE)                         | Enterprise Application Software (EAS)
       7801 | SAP CODVN F/G (PASSCODE) via RFC_READ_TABLE      | Enterprise Application Software (EAS)
      10300 | SAP CODVN H (PWDSALTEDHASH) iSSHA-1              | Enterprise Application Software (EAS)
       8600 | Lotus Notes/Domino 5                             | Enterprise Application Software (EAS)
       8700 | Lotus Notes/Domino 6                             | Enterprise Application Software (EAS)
       9100 | Lotus Notes/Domino 8                             | Enterprise Application Software (EAS)
        133 | PeopleSoft                                       | Enterprise Application Software (EAS)
      13500 | PeopleSoft PS_TOKEN                              | Enterprise Application Software (EAS)
      11600 | 7-Zip                                            | Archives
      12500 | RAR3-hp                                          | Archives
      13000 | RAR5                                             | Archives
      13200 | AxCrypt                                          | Archives
      13300 | AxCrypt in-memory SHA1                           | Archives
      13600 | WinZip                                           | Archives
      14700 | iTunes backup < 10.0                             | Backup
      14800 | iTunes backup >= 10.0                            | Backup
       62XY | TrueCrypt                                        | Full-Disk Encryption (FDE)
         X  | 1 = PBKDF2-HMAC-RIPEMD160                        | Full-Disk Encryption (FDE)
         X  | 2 = PBKDF2-HMAC-SHA512                           | Full-Disk Encryption (FDE)
         X  | 3 = PBKDF2-HMAC-Whirlpool                        | Full-Disk Encryption (FDE)
         X  | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode            | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure AES                        | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure Serpent                    | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure Twofish                    | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure AES                        | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure Serpent                    | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure Twofish                    | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded AES-Twofish            | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Serpent-AES            | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Twofish-Serpent        | Full-Disk Encryption (FDE)
          Y | 3 = XTS 1536 bit all                             | Full-Disk Encryption (FDE)
       8800 | Android FDE <= 4.3                               | Full-Disk Encryption (FDE)
      12900 | Android FDE (Samsung DEK)                        | Full-Disk Encryption (FDE)
      12200 | eCryptfs                                         | Full-Disk Encryption (FDE)
      137XY | VeraCrypt                                        | Full-Disk Encryption (FDE)
         X  | 1 = PBKDF2-HMAC-RIPEMD160                        | Full-Disk Encryption (FDE)
         X  | 2 = PBKDF2-HMAC-SHA512                           | Full-Disk Encryption (FDE)
         X  | 3 = PBKDF2-HMAC-Whirlpool                        | Full-Disk Encryption (FDE)
         X  | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode            | Full-Disk Encryption (FDE)
         X  | 5 = PBKDF2-HMAC-SHA256                           | Full-Disk Encryption (FDE)
         X  | 6 = PBKDF2-HMAC-SHA256 + boot-mode               | Full-Disk Encryption (FDE)
         X  | 7 = PBKDF2-HMAC-Streebog-512                     | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure AES                        | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure Serpent                    | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure Twofish                    | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure Camellia                   | Full-Disk Encryption (FDE)
          Y | 1 = XTS  512 bit pure Kuznyechik                 | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure AES                        | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure Serpent                    | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure Twofish                    | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure Camellia                   | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit pure Kuznyechik                 | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded AES-Twofish            | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Camellia-Kuznyechik    | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Camellia-Serpent       | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Kuznyechik-AES         | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Kuznyechik-Twofish     | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Serpent-AES            | Full-Disk Encryption (FDE)
          Y | 2 = XTS 1024 bit cascaded Twofish-Serpent        | Full-Disk Encryption (FDE)
          Y | 3 = XTS 1536 bit all                             | Full-Disk Encryption (FDE)
      14600 | LUKS                                             | Full-Disk Encryption (FDE)
      16700 | FileVault 2                                      | Full-Disk Encryption (FDE)
      18300 | Apple File System (APFS)                         | Full-Disk Encryption (FDE)
       9700 | MS Office <= 2003 $0/$1, MD5 + RC4               | Documents
       9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1  | Documents
       9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2  | Documents
       9800 | MS Office <= 2003 $3/$4, SHA1 + RC4              | Documents
       9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1    | Documents
       9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2    | Documents
       9400 | MS Office 2007                                   | Documents
       9500 | MS Office 2010                                   | Documents
       9600 | MS Office 2013                                   | Documents
      10400 | PDF 1.1 - 1.3 (Acrobat 2 - 4)                    | Documents
      10410 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1       | Documents
      10420 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2       | Documents
      10500 | PDF 1.4 - 1.6 (Acrobat 5 - 8)                    | Documents
      10600 | PDF 1.7 Level 3 (Acrobat 9)                      | Documents
      10700 | PDF 1.7 Level 8 (Acrobat 10 - 11)                | Documents
      16200 | Apple Secure Notes                               | Documents
       9000 | Password Safe v2                                 | Password Managers
       5200 | Password Safe v3                                 | Password Managers
       6800 | LastPass + LastPass sniffed                      | Password Managers
       6600 | 1Password, agilekeychain                         | Password Managers
       8200 | 1Password, cloudkeychain                         | Password Managers
      11300 | Bitcoin/Litecoin wallet.dat                      | Password Managers
      12700 | Blockchain, My Wallet                            | Password Managers
      15200 | Blockchain, My Wallet, V2                        | Password Managers
      16600 | Electrum Wallet (Salt-Type 1-3)                  | Password Managers
      13400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES)      | Password Managers
      15500 | JKS Java Key Store Private Keys (SHA1)           | Password Managers
      15600 | Ethereum Wallet, PBKDF2-HMAC-SHA256              | Password Managers
      15700 | Ethereum Wallet, SCRYPT                          | Password Managers
      16300 | Ethereum Pre-Sale Wallet, PBKDF2-HMAC-SHA256     | Password Managers
      16900 | Ansible Vault                                    | Password Managers
      18100 | TOTP (HMAC-SHA1)                                 | One-Time Passwords
      99999 | Plaintext                                        | Plaintext

    -a 破解模式

    指定要使用的破解模式,其值参考后面对参数

     
    R
    - [ Attack Modes ] -
    
      # | Mode
     ===+======
      0 | Straight                # 直接字典破解
      1 | Combination             # 组合破解
      3 | Brute-force             # 掩码暴力破解
      6 | Hybrid Wordlist + Mask  # 字典+掩码破解
      7 | Hybrid Mask + Wordlist  # 掩码+字典破解

    –increment

    启用增量破解模式,让hashcat在指定的密码长度范围内执行破解

    –increment-min

    密码最小长度,后面直接等于一个整数即可,配置increment模式一起使用

    –increment-max

    密码最大长度,后面直接等于一个整数即可,配置increment模式一起使用

    –force

    忽略破解过程中的警告信息

    –remove

    删除已被破解成功的hash

    –username

    忽略hash文件中的指定的用户名,在破解linux系统用户密码hash会用到

    –potfile-disable

    不在potfile中记录破解成功的hash

    -I

    --opencl-info显示有关检测到的OpenCL平台/设备的信息,如果有一块好的显卡的话破解速度会快很多。

    我的MacBook检测到了3个设备,分别是CPU、核显和独显

     
    Bash
    # sqlsec @ com in ~ [14:42:33] C:130
    $ hashcat -I
    hashcat (v5.1.0) starting...
    
    OpenCL Info:
    
    Platform ID #1
      Vendor  : Apple
      Name    : Apple
      Version : OpenCL 1.2 (Sep  5 2019 21:59:08)
    
      Device ID #1
        Type           : CPU
        Vendor ID      : 4
        Vendor         : Intel
        Name           : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
        Version        : OpenCL 1.2
        Processor(s)   : 12
        Clock          : 2600
        Memory         : 4096/16384 MB allocatable
        OpenCL Version : OpenCL C 1.2
        Driver Version : 1.1
    
      Device ID #2
        Type           : GPU
        Vendor ID      : 2147483648
        Vendor         : Intel Inc.
        Name           : Intel(R) UHD Graphics 630
        Version        : OpenCL 1.2
        Processor(s)   : 24
        Clock          : 1150
        Memory         : 384/1536 MB allocatable
        OpenCL Version : OpenCL C 1.2
        Driver Version : 1.2(Sep 25 2019 21:33:26)
    
      Device ID #3
        Type           : GPU
        Vendor ID      : 1
        Vendor         : AMD
        Name           : AMD Radeon Pro 555X Compute Engine
        Version        : OpenCL 1.2
        Processor(s)   : 12
        Clock          : 300
        Memory         : 1024/4096 MB allocatable
        OpenCL Version : OpenCL C 1.2
        Driver Version : 1.2 (Sep 25 2019 21:23:46)

    使用clinfo命令也可以看到你的设备的OpenCL相关信息:

     
    Bash
    # Linux 安装 clinfo
    apt install clinfo
    
    # macOS 安装 clinfo
    brew install clinfo
    
    # 查询 OpenCL 设备相关信息
    clinfo |grep 'Device Type'

    -o

    --outfile 指定破解成功后的hash及所对应的明文密码的存放位置

    -O

    --optimized-kernel-enable 启用优化的内核(限制密码长度)

    -d

    --opencl-devices指定opencl的设备,我这里支持的设备列表如下:

     
     
    * Device #1: Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz, skipped.
    * Device #2: Intel(R) UHD Graphics 630, 384/1536 MB allocatable, 24MCU
    * Device #3: AMD Radeon Pro 555X Compute Engine, 1024/4096 MB allocatable, 12MCU

    -D

    --opencl-device-types指定opencl的设备类型,Hashcat支持如下设备类型:

     
    Bash
     1 | CPU
     2 | GPU
     3 | FPGA, DSP, Co-Processor

    一般常用-D 2指定GPU破解

    所有参数

    参数类型描述案例
    -m, --hash-type Num Hash-type, see references below -m 1000
    -a, --attack-mode Num Attack-mode, see references below -a 3
    -V, --version   Print version  
    -h, --help   Print help  
    --quiet   Suppress output  
    --hex-charset   Assume charset is given in hex  
    --hex-salt   Assume salt is given in hex  
    --hex-wordlist   Assume words in wordlist are given in hex  
    --force   Ignore warnings  
    --status   Enable automatic update of the status screen  
    --status-timer Num Sets seconds between status screen updates to X --status-timer=1
    --stdin-timeout-abort Num Abort if there is no input from stdin for X seconds --stdin-timeout-abort=300
    --machine-readable   Display the status view in a machine-readable format  
    --keep-guessing   Keep guessing the hash after it has been cracked  
    --self-test-disable   Disable self-test functionality on startup  
    --loopback   Add new plains to induct directory  
    --markov-hcstat2 File Specify hcstat2 file to use --markov-hcstat2=my.hcstat2
    --markov-disable   Disables markov-chains, emulates classic brute-force  
    --markov-classic   Enables classic markov-chains, no per-position  
    -t, --markov-threshold Num Threshold X when to stop accepting new markov-chains -t 50
    --runtime Num Abort session after X seconds of runtime --runtime=10
    --session Str Define specific session name --session=mysession
    --restore   Restore session from –session  
    --restore-disable   Do not write restore file  
    --restore-file-path File Specific path to restore file --restore-file-path=x.restore
    -o, --outfile File Define outfile for recovered hash -o outfile.txt
    --outfile-format Num Define outfile-format X for recovered hash --outfile-format=7
    --outfile-autohex-disable   Disable the use of $HEX[] in output plains  
    --outfile-check-timer Num Sets seconds between outfile checks to X --outfile-check=30
    --wordlist-autohex-disable   Disable the conversion of $HEX[] from the wordlist  
    -p, --separator Char Separator char for hashlists and outfile -p :
    --stdout   Do not crack a hash, instead print candidates only  
    --show   Compare hashlist with potfile; show cracked hashes  
    --left   Compare hashlist with potfile; show uncracked hashes  
    --username   Enable ignoring of usernames in hashfile  
    --remove   Enable removal of hashes once they are cracked  
    --remove-timer Num Update input hash file each X seconds --remove-timer=30
    --potfile-disable   Do not write potfile  
    --potfile-path File Specific path to potfile --potfile-path=my.pot
    --encoding-from Code Force internal wordlist encoding from X --encoding-from=iso-8859-15
    --encoding-to Code Force internal wordlist encoding to X --encoding-to=utf-32le
    --debug-mode Num Defines the debug mode (hybrid only by using rules) --debug-mode=4
    --debug-file File Output file for debugging rules --debug-file=good.log
    --induction-dir Dir Specify the induction directory to use for loopback --induction=inducts
    --outfile-check-dir Dir Specify the outfile directory to monitor for plains --outfile-check-dir=x
    --logfile-disable   Disable the logfile  
    --hccapx-message-pair Num Load only message pairs from hccapx matching X --hccapx-message-pair=2
    --nonce-error-corrections Num The BF size range to replace AP’s nonce last bytes --nonce-error-corrections=16
    --keyboard-layout-mapping File Keyboard layout mapping table for special hash-modes --keyb=german.hckmap
    --truecrypt-keyfiles File Keyfiles to use, separated with commas --truecrypt-keyf=x.png
    --veracrypt-keyfiles File Keyfiles to use, separated with commas --veracrypt-keyf=x.txt
    --veracrypt-pim Num VeraCrypt personal iterations multiplier --veracrypt-pim=1000
    -b, --benchmark   Run benchmark of selected hash-modes  
    --benchmark-all   Run benchmark of all hash-modes (requires -b)  
    --speed-only   Return expected speed of the attack, then quit  
    --progress-only   Return ideal progress step size and time to process  
    -c, --segment-size Num Sets size in MB to cache from the wordfile to X -c 32
    --bitmap-min Num Sets minimum bits allowed for bitmaps to X --bitmap-min=24
    --bitmap-max Num Sets maximum bits allowed for bitmaps to X --bitmap-max=24
    --cpu-affinity Str Locks to CPU devices, separated with commas --cpu-affinity=1,2,3
    --example-hashes   Show an example hash for each hash-mode  
    -I, --opencl-info   Show info about detected OpenCL platforms/devices -I
    --opencl-platforms Str OpenCL platforms to use, separated with commas --opencl-platforms=2
    -d, --opencl-devices Str OpenCL devices to use, separated with commas -d 1
    -D, --opencl-device-types Str OpenCL device-types to use, separated with commas -D 1
    --opencl-vector-width Num Manually override OpenCL vector-width to X --opencl-vector=4
    -O, --optimized-kernel-enable   Enable optimized kernels (limits password length)  
    -w, --workload-profile Num Enable a specific workload profile, see pool below -w 3
    -n, --kernel-accel Num Manual workload tuning, set outerloop step size to X -n 64
    -u, --kernel-loops Num Manual workload tuning, set innerloop step size to X -u 256
    -T, --kernel-threads Num Manual workload tuning, set thread count to X -T 64
    --spin-damp Num Use CPU for device synchronization, in percent --spin-damp=50
    --hwmon-disable   Disable temperature and fanspeed reads and triggers  
    --hwmon-temp-abort Num Abort if temperature reaches X degrees Celsius --hwmon-temp-abort=100
    --scrypt-tmto Num Manually override TMTO value for scrypt to X --scrypt-tmto=3
    -s, --skip Num Skip X words from the start -s 1000000
    -l, --limit Num Limit X words from the start + skipped words -l 1000000
    --keyspace   Show keyspace base:mod values and quit  
    -j, --rule-left Rule Single rule applied to each word from left wordlist -j ‘c’
    -k, --rule-right Rule Single rule applied to each word from right wordlist -k ‘^-‘
    -r, --rules-file File Multiple rules applied to each word from wordlists -r rules/best64.rule
    -g, --generate-rules Num Generate X random rules -g 10000
    --generate-rules-func-min Num Force min X functions per rule  
    --generate-rules-func-max Num Force max X functions per rule  
    --generate-rules-seed Num Force RNG seed set to X  
    -1, --custom-charset1 CS User-defined charset ?1 -1 ?l?d?u
    -i, --increment   Enable mask increment mode  
    --increment-min Num Start mask incrementing at X --increment-min=4
    --increment-max Num Stop mask incrementing at X --increment-max=8
    -S, --slow-candidates   Enable slower (but advanced) candidate generators  
    --brain-server   Enable brain server  
    -z, --brain-client   Enable brain client, activates -S  
    --brain-client-features Num Define brain client features, see below --brain-client-features=3
    --brain-host Str Brain server host (IP or domain) --brain-host=127.0.0.1
    --brain-port Port Brain server port --brain-port=13743
    --brain-password Str Brain server authentication password --brain-password=bZfhCvGUSjRq
    --brain-session Hex Overrides automatically calculated brain session --brain-session=0x2ae611db
    --brain-session-whitelist Hex Allow given sessions only, separated with commas --brain-session-whitelist=0x2ae611db

    掩码破解

    掩码规则

     
    Bash
      ? | Charset
     ===+=========
      l | abcdefghijklmnopqrstuvwxyz          # 小写字母 a-z
      u | ABCDEFGHIJKLMNOPQRSTUVWXYZ          # 大写字母 A-Z
      d | 0123456789                          # 数字 0-9
      h | 0123456789abcdef                    # 数字 + abcdef
      H | 0123456789ABCDEF                    # 数字 + ABCDEF
      s |  !"#$%&'()*+,-./:;<=>?@[]^_`{|}~   # 特殊字符    
      a | ?l?u?d?s                            # 键盘上所有可见的字符
      b | 0x00 - 0xff                         # 可能是用来匹配像空格这种密码的

    自定义掩码规则

     
    Bash
    --custom-charset1 [chars]等价于 -1
    --custom-charset2 [chars]等价于 -2
    --custom-charset3 [chars]等价于 -3
    --custom-charset4 [chars]等价于 -4

    在掩码中用?1?2?3?4来表示

    一些案例:

     
    Bash
    --custom-charset1 abcd123456!@-+

    此时?1就表示abcd123456!@-+

     
    Bash
    --custom-charset2 ?l?d

    此时?2就表示?l?d?h 数字 + 小写字母

     
    Bash
    -3 abcdef -4 123456 

    此时?3?3?3?3?4?4?4?4就表示为前四位可能是abcdef,后四位可能是123456

    字典破解

    1q2w3e4r的MD5值为5416d7cd6ef195a0f7622a9c56b55e84

     
    Bash
    hashcat -a 0 -m 0 '5416d7cd6ef195a0f7622a9c56b55e84' hashpass.txt -o success.txt

    删除已破解密码

    有时候破解的时候会出现如下提示:

     
     
    INFO: All hashes found in potfile! Use --show to display them.

    这表明在之前该密码已经被我们破解成功了,Hashcat故不再显示出来,可以在后面添加参数--show来显示密码:

     
    Bash
    hashcat -a 0 -m 0 'cbc8f5435c87e13c5d14e6ce92358d68' hashpass.txt --show
    cbc8f5435c87e13c5d14e6ce92358d68:123456@abc

    Hashcat存放已经成功破解的密码文件位置为:~/.hashcat/hashcat.potfile

    如果想要直接显示破解的密码的话,可以直接删除掉该文件。

    批量破解

     
    Bash
    # 删除之前破解成功的记录
    rm ~/.hashcat/hashcat.potfile
    
    # hash.txt为要破解的密码 hashpass.txt为字典 导出破解的结果到success.txt 并从hash.txt删除掉破解成功的
    hashcat -a 0 -m 0 hash.txt hashpass.txt -o success.txt --remove

    组合破解

    多字典破解

     
    Bash
    hashcat -a 1 -m 0 '5416d7cd6ef195a0f7622a9c56b55e84' hashpass1.txt hashpass1.txt

    字典+掩码破解

     
    Bash
    echo -n admin888 |openssl md5
    7fef6171469e80d32c0559f88b377245

    破解admin888的MD5值:

     
    Bash
    hashcat -a 6 -m 0 '7fef6171469e80d32c0559f88b377245' hashpass.txt -O

    掩码+字典破解

     
    Bash
    hashcat -a 7 -m 0 '7fef6171469e80d32c0559f88b377245' 'admi?l?d?d?d' hashpass.txt  -O

    破解案例

    8位MD5加密的数字破解

    23323323进行MD5加密:

     
    Bash
    $ echo -n 23323323 |openssl md5
    5a745e31dbbd93f4c86d1ef82281688b

    使用Hashcat来进行破解:

     
    Bash
    hashcat -a 3 -m 0 --force '5a745e31dbbd93f4c86d1ef82281688b' '?d?d?d?d?d?d?d?d' -O

    8位MD5加密的大小写字母破解

     
    Bash
    $ echo -n PassWord |openssl md5
    a9d402bfcde5792a8b531b3a82669585

    使用Hashcat来进行破解:

    复制成功
    Bash
    hashcat -a 3 -m 0 -1 '?l?u' --force  'a9d402bfcde5792a8b531b3a82669585' '?1?1?1?1?1?1?1?1' -O

    这里面定义了个自定义规则-1,此时?1就表示?l?u,即大小写字母。

    5-7位MD5加密的大小写字母+数字破解

    Admin88的MD5值为d41e98d1eafa6d6011d3a70f1a5b92f0

     
    Bash
    hashcat -a 3 -m 0 -1 '?l?u?d' --force  '2792e40d60bac94b4b163b93566e65a9' --increment --increment-min 5 --increment-max 7 '?1?1?1?1?1?1?1' -O

    这里面定义了个自定义规则-1,此时?1就表示?l?u?d,即大小写字母+数字。

    admin开头10位MD5加密的大小写字母+数字破解

    admin23323的MD5值为a9991129897a44e0d1c2855c3d7dccc4

     
    Bash
    hashcat -a 3 -m 0 -1 '?l?u?d' --force  'a9991129897a44e0d1c2855c3d7dccc4' 'admin?1?1?1?1?1' -O

    MySQL4.1/MySQL5

    查看MySQL的密码:

     
    Mysql
    mysql> select Password from mysql.user;
    +-------------------------------------------+
    | Password                                  |
    +-------------------------------------------+
    | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
    | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
    | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
    | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
    +-------------------------------------------+
    4 rows in set (0.00 sec)

    然后开始使用字典破解:

     
    Bash
    hashcat -a 0 -m 300 --force '81F5E21E35407D884A6CD4A731AEBFB6AF209E1B' hashpass.txt -O

    Linux /etc/shadow sha512crypt $6$, SHA512 (Unix)

    查看/etc/shadow密码文件:

     
    Bash
    root@kali-linux:~# cat /etc/shadow
    root:$6$4ojiBMDPrehqrLkX$d2T7Cn8LKkLk4SDXgCh1IEqjhnsUekXaNUXSxiZIwUTndSqyd.9sEcu80sX9DuEHGmHOeoMev2O0ACYtjMett1:18201:0:99999:7:::
    daemon:*:18024:0:99999:7:::
    bin:*:18024:0:99999:7:::
    sys:*:18024:0:99999:7:::
    sync:*:18024:0:99999:7:::
    games:*:18024:0:99999:7:::
    man:*:18024:0:99999:7:::
    lp:*:18024:0:99999:7:::
    mail:*:18024:0:99999:7:::
    news:*:18024:0:99999:7:::
    uucp:*:18024:0:99999:7:::
    proxy:*:18024:0:99999:7:::
    www-data:*:18024:0:99999:7:::
    backup:*:18024:0:99999:7:::
    list:*:18024:0:99999:7:::
    irc:*:18024:0:99999:7:::
    gnats:*:18024:0:99999:7:::
    nobody:*:18024:0:99999:7:::
    _apt:*:18024:0:99999:7:::
    systemd-timesync:*:18024:0:99999:7:::
    systemd-network:*:18024:0:99999:7:::
    systemd-resolve:*:18024:0:99999:7:::
    mysql:!:18024:0:99999:7:::
    ntp:*:18024:0:99999:7:::
    messagebus:*:18024:0:99999:7:::
    arpwatch:!:18024:0:99999:7:::
    Debian-exim:!:18024:0:99999:7:::
    uuidd:*:18024:0:99999:7:::
    redsocks:!:18024:0:99999:7:::
    tss:*:18024:0:99999:7:::
    rwhod:*:18024:0:99999:7:::
    iodine:*:18024:0:99999:7:::
    miredo:*:18024:0:99999:7:::
    dnsmasq:*:18024:0:99999:7:::
    postgres:*:18024:0:99999:7:::
    usbmux:*:18024:0:99999:7:::
    rtkit:*:18024:0:99999:7:::
    stunnel4:!:18024:0:99999:7:::
    sshd:*:18024:0:99999:7:::
    Debian-snmp:!:18024:0:99999:7:::
    sslh:!:18024:0:99999:7:::
    pulse:*:18024:0:99999:7:::
    speech-dispatcher:!:18024:0:99999:7:::
    avahi:*:18024:0:99999:7:::
    saned:*:18024:0:99999:7:::
    inetsim:*:18024:0:99999:7:::
    colord:*:18024:0:99999:7:::
    geoclue:*:18024:0:99999:7:::
    king-phisher:*:18024:0:99999:7:::
    Debian-gdm:*:18024:0:99999:7:::
    dradis:*:18024:0:99999:7:::
    beef-xss:*:18024:0:99999:7:::
    systemd-coredump:!!:18082::::::

    可以看到root是有密码的,前面使用的是$6表面hash的加密方式为:sha512crypt $6$, SHA512 (Unix)

     
    Bash
    # 掩码破解root密码 不在potfile中记录破解成功的hash 指定设备2(核显)来跑密码 并开启优化
    hashcat -a 3 -m 1800 --force  '$6$4ojiBMDPrehqrLkX$d2T7Cn8LKkLk4SDXgCh1IEqjhnsUekXaNUXSxiZIwUTndSqyd.9sEcu80sX9DuEHGmHOeoMev2O0ACYtjMett1' '?l?l?l?l' -O -d 2 --potfile-disable
    
    # 掩码破解root密码 忽略用户名 不在potfile中记录破解成功的hash 指定设备2(核显)来跑密码 并开启优化
    hashcat -a 3 -m 1800 --force  'root:$6$4ojiBMDPrehqrLkX$d2T7Cn8LKkLk4SDXgCh1IEqjhnsUekXaNUXSxiZIwUTndSqyd.9sEcu80sX9DuEHGmHOeoMev2O0ACYtjMett1' '?l?l?l?l' -O -d 2 --username --potfile-disable 

    macOS下自带的CPU和独显无法破解,这里国光本人手动切换了-d 2用核显才成功跑出来:

    字典破解Windows LM Hash

     
    Bash
    hashcat -a 0 -m 3000 --force '921988ba001dc8e14a3b108f3fa6cb6d' password.txt

    字典破解Windows NTLM Hash

     
    Bash
    hashcat -a 0 -m 1000 --force 'e19ccf75ee54e06b06a5907af13cef42' password.txt

    分布破解

    该功能目前有点坑,现在本地测试还没有顺利成功过,留在这边待以后完善

    参数类型说明国光的理解示例
    –brain-server   Enable brain server 启用主服务器  
    -z, –brain-client   Enable brain client, activates -S 启用分布式客户端  
    –brain-client-features Num Define brain client features, see below 定义客户端功能 –brain-client-features=3
    –brain-host Str Brain server host (IP or domain) 主服务器的IP或者域 –brain-host=127.0.0.1
    –brain-port Port Brain server port 主服务器端口 –brain-port=13743
    –brain-password Str Brain server authentication password 主服务器的认证密码 –brain-password=e8acfc7280c48009
    –brain-session Hex Overrides automatically calculated brain session 自动覆盖已经计算的主会话 –brain-session=0x2ae611db
    –brain-session-whitelist Hex Allow given sessions only, separated with commas 仅允许给定的对话,以逗号分隔 –brain-session-whitelist=0x2ae611db

    客户端功能

     
    Bash
    - [ Brain Client Features ] -
    
      # | Features
     ===+========
      1 | Send hashed passwords                       # 发送已破解的密码
      2 | Send attack positions                       # 发送已破解的位置
      3 | Send hashed passwords and attack positions  # 发送已破解的密码和已破解的位置

    参考链接

    转载:

    文章作者: 国光
    这个大佬是真的nice!
    侵权必定删除,本人只是做个记录

    侵权必定删除,本人只是做个记录

  • 相关阅读:
    Md5
    hdu 2569 彼岸
    调用系统相机相冊
    白盒測试
    HDU 1501
    IOS常见错误分析解决(一直更新) 你值得收藏-综合贴
    读“程序猿生存定律”笔记
    Halcon导出的cpp, VC++环境配置
    POJ 1260 Pearls (动规)
    hdoj-1856-More is better【并查集】
  • 原文地址:https://www.cnblogs.com/shiniancc/p/13658749.html
Copyright © 2011-2022 走看看