当前位置:   article > 正文

宇宙最强破译器!!!HASHCAT(哈斯猫)--入门深度学习

hashcat

Hashcat 是一款密码爆破神器,信息安全必备工具之一,特此写篇文章记录总结之,以备不时之需,同时也可能帮助到看到本本文的网友。

简介

Hashcat 是世界上最快的密码破解程序,是一个支持多平台、多算法的开源的分布式工具。

官方:hashcat - advanced password recovery

Github:GitHub - hashcat/hashcat: World's fastest and most advanced password recovery utility

安装

macOS

BASH

  1. # 安装hashcat
  2. brew install hashcat
  3. # 查看版本
  4. hashcat --version

Linux

Kali Linux 内置 Hashcat,在 Deepin Linux 和 Ubuntu Linux 下可以直接使用 APT 来安装:

BASH

  1. apt update && apt install hashcat
  2. # 查看版本
  3. hashcat --version

也可以手动解压运行二进制文件 Releases · hashcat/hashcat · GitHub 下载最新版压缩包:

BASH

  1. # 解压
  2. tar zxvf hashcat-5.1.0.7z
  3. cd hashcat-5.1.0
  4. # 根据自己的平台执行对应的二进制文件
  5. ./hashcat64.bin
  6. ./hashcat32.bin

Windows

Releases · hashcat/hashcat · GitHub 下载最新版压缩包,解压根据自己的平台运行 hashcat64.exe 或者 hashcat32.exe

常用参数

-m 破解 hash 类型

指定要破解的 hash 类型,后面跟 hash 类型对应的数字,具体类型详见下表:

BASH

  1. - [ Hash modes ] -
  2. # | Name | Category
  3. ======+==================================================+======================================
  4. 900 | MD4 | Raw Hash
  5. 0 | MD5 | Raw Hash
  6. 5100 | Half MD5 | Raw Hash
  7. 100 | SHA1 | Raw Hash
  8. 1300 | SHA2-224 | Raw Hash
  9. 1400 | SHA2-256 | Raw Hash
  10. 10800 | SHA2-384 | Raw Hash
  11. 1700 | SHA2-512 | Raw Hash
  12. 17300 | SHA3-224 | Raw Hash
  13. 17400 | SHA3-256 | Raw Hash
  14. 17500 | SHA3-384 | Raw Hash
  15. 17600 | SHA3-512 | Raw Hash
  16. 17700 | Keccak-224 | Raw Hash
  17. 17800 | Keccak-256 | Raw Hash
  18. 17900 | Keccak-384 | Raw Hash
  19. 18000 | Keccak-512 | Raw Hash
  20. 600 | BLAKE2b-512 | Raw Hash
  21. 10100 | SipHash | Raw Hash
  22. 6000 | RIPEMD-160 | Raw Hash
  23. 6100 | Whirlpool | Raw Hash
  24. 6900 | GOST R 34.11-94 | Raw Hash
  25. 11700 | GOST R 34.11-2012 (Streebog) 256-bit, big-endian | Raw Hash
  26. 11800 | GOST R 34.11-2012 (Streebog) 512-bit, big-endian | Raw Hash
  27. 10 | md5($pass.$salt) | Raw Hash, Salted and/or Iterated
  28. 20 | md5($salt.$pass) | Raw Hash, Salted and/or Iterated
  29. 30 | md5(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated
  30. 40 | md5($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated
  31. 3800 | md5($salt.$pass.$salt) | Raw Hash, Salted and/or Iterated
  32. 3710 | md5($salt.md5($pass)) | Raw Hash, Salted and/or Iterated
  33. 4010 | md5($salt.md5($salt.$pass)) | Raw Hash, Salted and/or Iterated
  34. 4110 | md5($salt.md5($pass.$salt)) | Raw Hash, Salted and/or Iterated
  35. 2600 | md5(md5($pass)) | Raw Hash, Salted and/or Iterated
  36. 3910 | md5(md5($pass).md5($salt)) | Raw Hash, Salted and/or Iterated
  37. 4300 | md5(strtoupper(md5($pass))) | Raw Hash, Salted and/or Iterated
  38. 4400 | md5(sha1($pass)) | Raw Hash, Salted and/or Iterated
  39. 110 | sha1($pass.$salt) | Raw Hash, Salted and/or Iterated
  40. 120 | sha1($salt.$pass) | Raw Hash, Salted and/or Iterated
  41. 130 | sha1(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated
  42. 140 | sha1($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated
  43. 4500 | sha1(sha1($pass)) | Raw Hash, Salted and/or Iterated
  44. 4520 | sha1($salt.sha1($pass)) | Raw Hash, Salted and/or Iterated
  45. 4700 | sha1(md5($pass)) | Raw Hash, Salted and/or Iterated
  46. 4900 | sha1($salt.$pass.$salt) | Raw Hash, Salted and/or Iterated
  47. 14400 | sha1(CX) | Raw Hash, Salted and/or Iterated
  48. 1410 | sha256($pass.$salt) | Raw Hash, Salted and/or Iterated
  49. 1420 | sha256($salt.$pass) | Raw Hash, Salted and/or Iterated
  50. 1430 | sha256(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated
  51. 1440 | sha256($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated
  52. 1710 | sha512($pass.$salt) | Raw Hash, Salted and/or Iterated
  53. 1720 | sha512($salt.$pass) | Raw Hash, Salted and/or Iterated
  54. 1730 | sha512(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated
  55. 1740 | sha512($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated
  56. 50 | HMAC-MD5 (key = $pass) | Raw Hash, Authenticated
  57. 60 | HMAC-MD5 (key = $salt) | Raw Hash, Authenticated
  58. 150 | HMAC-SHA1 (key = $pass) | Raw Hash, Authenticated
  59. 160 | HMAC-SHA1 (key = $salt) | Raw Hash, Authenticated
  60. 1450 | HMAC-SHA256 (key = $pass) | Raw Hash, Authenticated
  61. 1460 | HMAC-SHA256 (key = $salt) | Raw Hash, Authenticated
  62. 1750 | HMAC-SHA512 (key = $pass) | Raw Hash, Authenticated
  63. 1760 | HMAC-SHA512 (key = $salt) | Raw Hash, Authenticated
  64. 11750 | HMAC-Streebog-256 (key = $pass), big-endian | Raw Hash, Authenticated
  65. 11760 | HMAC-Streebog-256 (key = $salt), big-endian | Raw Hash, Authenticated
  66. 11850 | HMAC-Streebog-512 (key = $pass), big-endian | Raw Hash, Authenticated
  67. 11860 | HMAC-Streebog-512 (key = $salt), big-endian | Raw Hash, Authenticated
  68. 14000 | DES (PT = $salt, key = $pass) | Raw Cipher, Known-Plaintext attack
  69. 14100 | 3DES (PT = $salt, key = $pass) | Raw Cipher, Known-Plaintext attack
  70. 14900 | Skip32 (PT = $salt, key = $pass) | Raw Cipher, Known-Plaintext attack
  71. 15400 | ChaCha20 | Raw Cipher, Known-Plaintext attack
  72. 400 | phpass | Generic KDF
  73. 8900 | scrypt | Generic KDF
  74. 11900 | PBKDF2-HMAC-MD5 | Generic KDF
  75. 12000 | PBKDF2-HMAC-SHA1 | Generic KDF
  76. 10900 | PBKDF2-HMAC-SHA256 | Generic KDF
  77. 12100 | PBKDF2-HMAC-SHA512 | Generic KDF
  78. 23 | Skype | Network Protocols
  79. 2500 | WPA-EAPOL-PBKDF2 | Network Protocols
  80. 2501 | WPA-EAPOL-PMK | Network Protocols
  81. 16800 | WPA-PMKID-PBKDF2 | Network Protocols
  82. 16801 | WPA-PMKID-PMK | Network Protocols
  83. 4800 | iSCSI CHAP authentication, MD5(CHAP) | Network Protocols
  84. 5300 | IKE-PSK MD5 | Network Protocols
  85. 5400 | IKE-PSK SHA1 | Network Protocols
  86. 5500 | NetNTLMv1 | Network Protocols
  87. 5500 | NetNTLMv1+ESS | Network Protocols
  88. 5600 | NetNTLMv2 | Network Protocols
  89. 7300 | IPMI2 RAKP HMAC-SHA1 | Network Protocols
  90. 7500 | Kerberos 5 AS-REQ Pre-Auth etype 23 | Network Protocols
  91. 8300 | DNSSEC (NSEC3) | Network Protocols
  92. 10200 | CRAM-MD5 | Network Protocols
  93. 11100 | PostgreSQL CRAM (MD5) | Network Protocols
  94. 11200 | MySQL CRAM (SHA1) | Network Protocols
  95. 11400 | SIP digest authentication (MD5) | Network Protocols
  96. 13100 | Kerberos 5 TGS-REP etype 23 | Network Protocols
  97. 16100 | TACACS+ | Network Protocols
  98. 16500 | JWT (JSON Web Token) | Network Protocols
  99. 18200 | Kerberos 5 AS-REP etype 23 | Network Protocols
  100. 121 | SMF (Simple Machines Forum) > v1.1 | Forums, CMS, E-Commerce, Frameworks
  101. 400 | phpBB3 (MD5) | Forums, CMS, E-Commerce, Frameworks
  102. 2611 | vBulletin < v3.8.5 | Forums, CMS, E-Commerce, Frameworks
  103. 2711 | vBulletin >= v3.8.5 | Forums, CMS, E-Commerce, Frameworks
  104. 2811 | MyBB 1.2+ | Forums, CMS, E-Commerce, Frameworks
  105. 2811 | IPB2+ (Invision Power Board) | Forums, CMS, E-Commerce, Frameworks
  106. 8400 | WBB3 (Woltlab Burning Board) | Forums, CMS, E-Commerce, Frameworks
  107. 11 | Joomla < 2.5.18 | Forums, CMS, E-Commerce, Frameworks
  108. 400 | Joomla >= 2.5.18 (MD5) | Forums, CMS, E-Commerce, Frameworks
  109. 400 | WordPress (MD5) | Forums, CMS, E-Commerce, Frameworks
  110. 2612 | PHPS | Forums, CMS, E-Commerce, Frameworks
  111. 7900 | Drupal7 | Forums, CMS, E-Commerce, Frameworks
  112. 21 | osCommerce | Forums, CMS, E-Commerce, Frameworks
  113. 21 | xt:Commerce | Forums, CMS, E-Commerce, Frameworks
  114. 11000 | PrestaShop | Forums, CMS, E-Commerce, Frameworks
  115. 124 | Django (SHA-1) | Forums, CMS, E-Commerce, Frameworks
  116. 10000 | Django (PBKDF2-SHA256) | Forums, CMS, E-Commerce, Frameworks
  117. 16000 | Tripcode | Forums, CMS, E-Commerce, Frameworks
  118. 3711 | MediaWiki B type | Forums, CMS, E-Commerce, Frameworks
  119. 13900 | OpenCart | Forums, CMS, E-Commerce, Frameworks
  120. 4521 | Redmine | Forums, CMS, E-Commerce, Frameworks
  121. 4522 | PunBB | Forums, CMS, E-Commerce, Frameworks
  122. 12001 | Atlassian (PBKDF2-HMAC-SHA1) | Forums, CMS, E-Commerce, Frameworks
  123. 12 | PostgreSQL | Database Server
  124. 131 | MSSQL (2000) | Database Server
  125. 132 | MSSQL (2005) | Database Server
  126. 1731 | MSSQL (2012, 2014) | Database Server
  127. 200 | MySQL323 | Database Server
  128. 300 | MySQL4.1/MySQL5 | Database Server
  129. 3100 | Oracle H: Type (Oracle 7+) | Database Server
  130. 112 | Oracle S: Type (Oracle 11+) | Database Server
  131. 12300 | Oracle T: Type (Oracle 12+) | Database Server
  132. 8000 | Sybase ASE | Database Server
  133. 141 | Episerver 6.x < .NET 4 | HTTP, SMTP, LDAP Server
  134. 1441 | Episerver 6.x >= .NET 4 | HTTP, SMTP, LDAP Server
  135. 1600 | Apache $apr1$ MD5, md5apr1, MD5 (APR) | HTTP, SMTP, LDAP Server
  136. 12600 | ColdFusion 10+ | HTTP, SMTP, LDAP Server
  137. 1421 | hMailServer | HTTP, SMTP, LDAP Server
  138. 101 | nsldap, SHA-1(Base64), Netscape LDAP SHA | HTTP, SMTP, LDAP Server
  139. 111 | nsldaps, SSHA-1(Base64), Netscape LDAP SSHA | HTTP, SMTP, LDAP Server
  140. 1411 | SSHA-256(Base64), LDAP {SSHA256} | HTTP, SMTP, LDAP Server
  141. 1711 | SSHA-512(Base64), LDAP {SSHA512} | HTTP, SMTP, LDAP Server
  142. 16400 | CRAM-MD5 Dovecot | HTTP, SMTP, LDAP Server
  143. 15000 | FileZilla Server >= 0.9.55 | FTP Server
  144. 11500 | CRC32 | Checksums
  145. 3000 | LM | Operating Systems
  146. 1000 | NTLM | Operating Systems
  147. 1100 | Domain Cached Credentials (DCC), MS Cache | Operating Systems
  148. 2100 | Domain Cached Credentials 2 (DCC2), MS Cache 2 | Operating Systems
  149. 15300 | DPAPI masterkey file v1 | Operating Systems
  150. 15900 | DPAPI masterkey file v2 | Operating Systems
  151. 12800 | MS-AzureSync PBKDF2-HMAC-SHA256 | Operating Systems
  152. 1500 | descrypt, DES (Unix), Traditional DES | Operating Systems
  153. 12400 | BSDi Crypt, Extended DES | Operating Systems
  154. 500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating Systems
  155. 3200 | bcrypt $2*$, Blowfish (Unix) | Operating Systems
  156. 7400 | sha256crypt $5$, SHA256 (Unix) | Operating Systems
  157. 1800 | sha512crypt $6$, SHA512 (Unix) | Operating Systems
  158. 122 | macOS v10.4, MacOS v10.5, MacOS v10.6 | Operating Systems
  159. 1722 | macOS v10.7 | Operating Systems
  160. 7100 | macOS v10.8+ (PBKDF2-SHA512) | Operating Systems
  161. 6300 | AIX {smd5} | Operating Systems
  162. 6700 | AIX {ssha1} | Operating Systems
  163. 6400 | AIX {ssha256} | Operating Systems
  164. 6500 | AIX {ssha512} | Operating Systems
  165. 2400 | Cisco-PIX MD5 | Operating Systems
  166. 2410 | Cisco-ASA MD5 | Operating Systems
  167. 500 | Cisco-IOS $1$ (MD5) | Operating Systems
  168. 5700 | Cisco-IOS type 4 (SHA256) | Operating Systems
  169. 9200 | Cisco-IOS $8$ (PBKDF2-SHA256) | Operating Systems
  170. 9300 | Cisco-IOS $9$ (scrypt) | Operating Systems
  171. 22 | Juniper NetScreen/SSG (ScreenOS) | Operating Systems
  172. 501 | Juniper IVE | Operating Systems
  173. 15100 | Juniper/NetBSD sha1crypt | Operating Systems
  174. 7000 | FortiGate (FortiOS) | Operating Systems
  175. 5800 | Samsung Android Password/PIN | Operating Systems
  176. 13800 | Windows Phone 8+ PIN/password | Operating Systems
  177. 8100 | Citrix NetScaler | Operating Systems
  178. 8500 | RACF | Operating Systems
  179. 7200 | GRUB 2 | Operating Systems
  180. 9900 | Radmin2 | Operating Systems
  181. 125 | ArubaOS | Operating Systems
  182. 7700 | SAP CODVN B (BCODE) | Enterprise Application Software (EAS)
  183. 7701 | SAP CODVN B (BCODE) via RFC_READ_TABLE | Enterprise Application Software (EAS)
  184. 7800 | SAP CODVN F/G (PASSCODE) | Enterprise Application Software (EAS)
  185. 7801 | SAP CODVN F/G (PASSCODE) via RFC_READ_TABLE | Enterprise Application Software (EAS)
  186. 10300 | SAP CODVN H (PWDSALTEDHASH) iSSHA-1 | Enterprise Application Software (EAS)
  187. 8600 | Lotus Notes/Domino 5 | Enterprise Application Software (EAS)
  188. 8700 | Lotus Notes/Domino 6 | Enterprise Application Software (EAS)
  189. 9100 | Lotus Notes/Domino 8 | Enterprise Application Software (EAS)
  190. 133 | PeopleSoft | Enterprise Application Software (EAS)
  191. 13500 | PeopleSoft PS_TOKEN | Enterprise Application Software (EAS)
  192. 11600 | 7-Zip | Archives
  193. 12500 | RAR3-hp | Archives
  194. 13000 | RAR5 | Archives
  195. 13200 | AxCrypt | Archives
  196. 13300 | AxCrypt in-memory SHA1 | Archives
  197. 13600 | WinZip | Archives
  198. 14700 | iTunes backup < 10.0 | Backup
  199. 14800 | iTunes backup >= 10.0 | Backup
  200. 62XY | TrueCrypt | Full-Disk Encryption (FDE)
  201. X | 1 = PBKDF2-HMAC-RIPEMD160 | Full-Disk Encryption (FDE)
  202. X | 2 = PBKDF2-HMAC-SHA512 | Full-Disk Encryption (FDE)
  203. X | 3 = PBKDF2-HMAC-Whirlpool | Full-Disk Encryption (FDE)
  204. X | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode | Full-Disk Encryption (FDE)
  205. Y | 1 = XTS 512 bit pure AES | Full-Disk Encryption (FDE)
  206. Y | 1 = XTS 512 bit pure Serpent | Full-Disk Encryption (FDE)
  207. Y | 1 = XTS 512 bit pure Twofish | Full-Disk Encryption (FDE)
  208. Y | 2 = XTS 1024 bit pure AES | Full-Disk Encryption (FDE)
  209. Y | 2 = XTS 1024 bit pure Serpent | Full-Disk Encryption (FDE)
  210. Y | 2 = XTS 1024 bit pure Twofish | Full-Disk Encryption (FDE)
  211. Y | 2 = XTS 1024 bit cascaded AES-Twofish | Full-Disk Encryption (FDE)
  212. Y | 2 = XTS 1024 bit cascaded Serpent-AES | Full-Disk Encryption (FDE)
  213. Y | 2 = XTS 1024 bit cascaded Twofish-Serpent | Full-Disk Encryption (FDE)
  214. Y | 3 = XTS 1536 bit all | Full-Disk Encryption (FDE)
  215. 8800 | Android FDE <= 4.3 | Full-Disk Encryption (FDE)
  216. 12900 | Android FDE (Samsung DEK) | Full-Disk Encryption (FDE)
  217. 12200 | eCryptfs | Full-Disk Encryption (FDE)
  218. 137XY | VeraCrypt | Full-Disk Encryption (FDE)
  219. X | 1 = PBKDF2-HMAC-RIPEMD160 | Full-Disk Encryption (FDE)
  220. X | 2 = PBKDF2-HMAC-SHA512 | Full-Disk Encryption (FDE)
  221. X | 3 = PBKDF2-HMAC-Whirlpool | Full-Disk Encryption (FDE)
  222. X | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode | Full-Disk Encryption (FDE)
  223. X | 5 = PBKDF2-HMAC-SHA256 | Full-Disk Encryption (FDE)
  224. X | 6 = PBKDF2-HMAC-SHA256 + boot-mode | Full-Disk Encryption (FDE)
  225. X | 7 = PBKDF2-HMAC-Streebog-512 | Full-Disk Encryption (FDE)
  226. Y | 1 = XTS 512 bit pure AES | Full-Disk Encryption (FDE)
  227. Y | 1 = XTS 512 bit pure Serpent | Full-Disk Encryption (FDE)
  228. Y | 1 = XTS 512 bit pure Twofish | Full-Disk Encryption (FDE)
  229. Y | 1 = XTS 512 bit pure Camellia | Full-Disk Encryption (FDE)
  230. Y | 1 = XTS 512 bit pure Kuznyechik | Full-Disk Encryption (FDE)
  231. Y | 2 = XTS 1024 bit pure AES | Full-Disk Encryption (FDE)
  232. Y | 2 = XTS 1024 bit pure Serpent | Full-Disk Encryption (FDE)
  233. Y | 2 = XTS 1024 bit pure Twofish | Full-Disk Encryption (FDE)
  234. Y | 2 = XTS 1024 bit pure Camellia | Full-Disk Encryption (FDE)
  235. Y | 2 = XTS 1024 bit pure Kuznyechik | Full-Disk Encryption (FDE)
  236. Y | 2 = XTS 1024 bit cascaded AES-Twofish | Full-Disk Encryption (FDE)
  237. Y | 2 = XTS 1024 bit cascaded Camellia-Kuznyechik | Full-Disk Encryption (FDE)
  238. Y | 2 = XTS 1024 bit cascaded Camellia-Serpent | Full-Disk Encryption (FDE)
  239. Y | 2 = XTS 1024 bit cascaded Kuznyechik-AES | Full-Disk Encryption (FDE)
  240. Y | 2 = XTS 1024 bit cascaded Kuznyechik-Twofish | Full-Disk Encryption (FDE)
  241. Y | 2 = XTS 1024 bit cascaded Serpent-AES | Full-Disk Encryption (FDE)
  242. Y | 2 = XTS 1024 bit cascaded Twofish-Serpent | Full-Disk Encryption (FDE)
  243. Y | 3 = XTS 1536 bit all | Full-Disk Encryption (FDE)
  244. 14600 | LUKS | Full-Disk Encryption (FDE)
  245. 16700 | FileVault 2 | Full-Disk Encryption (FDE)
  246. 18300 | Apple File System (APFS) | Full-Disk Encryption (FDE)
  247. 9700 | MS Office <= 2003 $0/$1, MD5 + RC4 | Documents
  248. 9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1 | Documents
  249. 9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2 | Documents
  250. 9800 | MS Office <= 2003 $3/$4, SHA1 + RC4 | Documents
  251. 9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1 | Documents
  252. 9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2 | Documents
  253. 9400 | MS Office 2007 | Documents
  254. 9500 | MS Office 2010 | Documents
  255. 9600 | MS Office 2013 | Documents
  256. 10400 | PDF 1.1 - 1.3 (Acrobat 2 - 4) | Documents
  257. 10410 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 | Documents
  258. 10420 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2 | Documents
  259. 10500 | PDF 1.4 - 1.6 (Acrobat 5 - 8) | Documents
  260. 10600 | PDF 1.7 Level 3 (Acrobat 9) | Documents
  261. 10700 | PDF 1.7 Level 8 (Acrobat 10 - 11) | Documents
  262. 16200 | Apple Secure Notes | Documents
  263. 9000 | Password Safe v2 | Password Managers
  264. 5200 | Password Safe v3 | Password Managers
  265. 6800 | LastPass + LastPass sniffed | Password Managers
  266. 6600 | 1Password, agilekeychain | Password Managers
  267. 8200 | 1Password, cloudkeychain | Password Managers
  268. 11300 | Bitcoin/Litecoin wallet.dat | Password Managers
  269. 12700 | Blockchain, My Wallet | Password Managers
  270. 15200 | Blockchain, My Wallet, V2 | Password Managers
  271. 16600 | Electrum Wallet (Salt-Type 1-3) | Password Managers
  272. 13400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES) | Password Managers
  273. 15500 | JKS Java Key Store Private Keys (SHA1) | Password Managers
  274. 15600 | Ethereum Wallet, PBKDF2-HMAC-SHA256 | Password Managers
  275. 15700 | Ethereum Wallet, SCRYPT | Password Managers
  276. 16300 | Ethereum Pre-Sale Wallet, PBKDF2-HMAC-SHA256 | Password Managers
  277. 16900 | Ansible Vault | Password Managers
  278. 18100 | TOTP (HMAC-SHA1) | One-Time Passwords
  279. 99999 | Plaintext | Plaintext

-a 破解模式

指定要使用的破解模式,其值参考后面对参数:

R

  1. - [ Attack Modes ] -
  2. # | Mode
  3. ===+======
  4. 0 | Straight # 直接字典破解
  5. 1 | Combination # 组合破解
  6. 3 | Brute-force # 掩码暴力破解
  7. 6 | Hybrid Wordlist + Mask # 字典+掩码破解
  8. 7 | Hybrid Mask + Wordlist # 掩码+字典破解

–increment

启用增量破解模式,让 hashcat 在指定的密码长度范围内执行破解

–increment-min

密码最小长度,后面直接等于一个整数即可,配置 increment 模式一起使用

–increment-max

密码最大长度,后面直接等于一个整数即可,配置 increment 模式一起使用

–force

忽略破解过程中的警告信息

–remove

删除已被破解成功的 hash

–username

忽略 hash 文件中的指定的用户名,在破解 Linux 系统用户密码 hash 会用到

–potfile-disable

不在 potfile 中记录破解成功的 hash

-I

--opencl-info 显示有关检测到的 OpenCL 平台 / 设备的信息,如果有一块好的显卡的话破解速度会快很多。

我的 MacBook 检测到了 3 个设备,分别是 CPU、核显和独显

BASH

  1. # sqlsec @ com in ~ [14:42:33] C:130
  2. $ hashcat -I
  3. hashcat (v5.1.0) starting...
  4. OpenCL Info:
  5. Platform ID #1
  6. Vendor : Apple
  7. Name : Apple
  8. Version : OpenCL 1.2 (Sep 5 2019 21:59:08)
  9. Device ID #1
  10. Type : CPU
  11. Vendor ID : 4
  12. Vendor : Intel
  13. Name : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
  14. Version : OpenCL 1.2
  15. Processor(s) : 12
  16. Clock : 2600
  17. Memory : 4096/16384 MB allocatable
  18. OpenCL Version : OpenCL C 1.2
  19. Driver Version : 1.1
  20. Device ID #2
  21. Type : GPU
  22. Vendor ID : 2147483648
  23. Vendor : Intel Inc.
  24. Name : Intel(R) UHD Graphics 630
  25. Version : OpenCL 1.2
  26. Processor(s) : 24
  27. Clock : 1150
  28. Memory : 384/1536 MB allocatable
  29. OpenCL Version : OpenCL C 1.2
  30. Driver Version : 1.2(Sep 25 2019 21:33:26)
  31. Device ID #3
  32. Type : GPU
  33. Vendor ID : 1
  34. Vendor : AMD
  35. Name : AMD Radeon Pro 555X Compute Engine
  36. Version : OpenCL 1.2
  37. Processor(s) : 12
  38. Clock : 300
  39. Memory : 1024/4096 MB allocatable
  40. OpenCL Version : OpenCL C 1.2
  41. Driver Version : 1.2 (Sep 25 2019 21:23:46)

使用 clinfo 命令也可以看到你的设备的 OpenCL 相关信息:

BASH

  1. # Linux 安装 clinfo
  2. apt install clinfo
  3. # macOS 安装 clinfo
  4. brew install clinfo
  5. # 查询 OpenCL 设备相关信息
  6. clinfo |grep 'Device Type'

​编辑

-o

--outfile 指定破解成功后的 hash 及所对应的明文密码的存放位置

-O

--optimized-kernel-enable 启用优化的内核(限制密码长度)

-d

--opencl-devices 指定 opencl 的设备,我这里支持的设备列表如下:

CODE

  1. * Device #1: Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz, skipped.
  2. * Device #2: Intel(R) UHD Graphics 630, 384/1536 MB allocatable, 24MCU
  3. * Device #3: AMD Radeon Pro 555X Compute Engine, 1024/4096 MB allocatable, 12MCU

-D

--opencl-device-types 指定 opencl 的设备类型,Hashcat 支持如下设备类型:

BASH

  1. 1 | CPU
  2. 2 | GPU
  3. 3 | FPGA, DSP, Co-Processor

一般常用 -D 2 指定 GPU 破解

所有参数

参数类型描述案例
-m, --hash-typeNumHash-type, see references below-m 1000
-a, --attack-modeNumAttack-mode, see references below-a 3
-V, --versionPrint version
-h, --helpPrint help
--quietSuppress output
--hex-charsetAssume charset is given in hex
--hex-saltAssume salt is given in hex
--hex-wordlistAssume words in wordlist are given in hex
--forceIgnore warnings
--statusEnable automatic update of the status screen
--status-timerNumSets seconds between status screen updates to X--status-timer=1
--stdin-timeout-abortNumAbort if there is no input from stdin for X seconds--stdin-timeout-abort=300
--machine-readableDisplay the status view in a machine-readable format
--keep-guessingKeep guessing the hash after it has been cracked
--self-test-disableDisable self-test functionality on startup
--loopbackAdd new plains to induct directory
--markov-hcstat2FileSpecify hcstat2 file to use--markov-hcstat2=my.hcstat2
--markov-disableDisables markov-chains, emulates classic brute-force
--markov-classicEnables classic markov-chains, no per-position
-t, --markov-thresholdNumThreshold X when to stop accepting new markov-chains-t 50
--runtimeNumAbort session after X seconds of runtime--runtime=10
--sessionStrDefine specific session name--session=mysession
--restoreRestore session from –session
--restore-disableDo not write restore file
--restore-file-pathFileSpecific path to restore file--restore-file-path=x.restore
-o, --outfileFileDefine outfile for recovered hash-o outfile.txt
--outfile-formatNumDefine outfile-format X for recovered hash--outfile-format=7
--outfile-autohex-disableDisable the use of $HEX[] in output plains
--outfile-check-timerNumSets seconds between outfile checks to X--outfile-check=30
--wordlist-autohex-disableDisable the conversion of $HEX[] from the wordlist
-p, --separatorCharSeparator char for hashlists and outfile-p :
--stdoutDo not crack a hash, instead print candidates only
--showCompare hashlist with potfile; show cracked hashes
--leftCompare hashlist with potfile; show uncracked hashes
--usernameEnable ignoring of usernames in hashfile
--removeEnable removal of hashes once they are cracked
--remove-timerNumUpdate input hash file each X seconds--remove-timer=30
--potfile-disableDo not write potfile
--potfile-pathFileSpecific path to potfile--potfile-path=my.pot
--encoding-fromCodeForce internal wordlist encoding from X--encoding-from=iso-8859-15
--encoding-toCodeForce internal wordlist encoding to X--encoding-to=utf-32le
--debug-modeNumDefines the debug mode (hybrid only by using rules)--debug-mode=4
--debug-fileFileOutput file for debugging rules--debug-file=good.log
--induction-dirDirSpecify the induction directory to use for loopback--induction=inducts
--outfile-check-dirDirSpecify the outfile directory to monitor for plains--outfile-check-dir=x
--logfile-disableDisable the logfile
--hccapx-message-pairNumLoad only message pairs from hccapx matching X--hccapx-message-pair=2
--nonce-error-correctionsNumThe BF size range to replace AP’s nonce last bytes--nonce-error-corrections=16
--keyboard-layout-mappingFileKeyboard layout mapping table for special hash-modes--keyb=german.hckmap
--truecrypt-keyfilesFileKeyfiles to use, separated with commas--truecrypt-keyf=x.png
--veracrypt-keyfilesFileKeyfiles to use, separated with commas--veracrypt-keyf=x.txt
--veracrypt-pimNumVeraCrypt personal iterations multiplier--veracrypt-pim=1000
-b, --benchmarkRun benchmark of selected hash-modes
--benchmark-allRun benchmark of all hash-modes (requires -b)
--speed-onlyReturn expected speed of the attack, then quit
--progress-onlyReturn ideal progress step size and time to process
-c, --segment-sizeNumSets size in MB to cache from the wordfile to X-c 32
--bitmap-minNumSets minimum bits allowed for bitmaps to X--bitmap-min=24
--bitmap-maxNumSets maximum bits allowed for bitmaps to X--bitmap-max=24
--cpu-affinityStrLocks to CPU devices, separated with commas--cpu-affinity=1,2,3
--example-hashesShow an example hash for each hash-mode
-I, --opencl-infoShow info about detected OpenCL platforms/devices-I
--opencl-platformsStrOpenCL platforms to use, separated with commas--opencl-platforms=2
-d, --opencl-devicesStrOpenCL devices to use, separated with commas-d 1
-D, --opencl-device-typesStrOpenCL device-types to use, separated with commas-D 1
--opencl-vector-widthNumManually override OpenCL vector-width to X--opencl-vector=4
-O, --optimized-kernel-enableEnable optimized kernels (limits password length)
-w, --workload-profileNumEnable a specific workload profile, see pool below-w 3
-n, --kernel-accelNumManual workload tuning, set outerloop step size to X-n 64
-u, --kernel-loopsNumManual workload tuning, set innerloop step size to X-u 256
-T, --kernel-threadsNumManual workload tuning, set thread count to X-T 64
--spin-dampNumUse CPU for device synchronization, in percent--spin-damp=50
--hwmon-disableDisable temperature and fanspeed reads and triggers
--hwmon-temp-abortNumAbort if temperature reaches X degrees Celsius--hwmon-temp-abort=100
--scrypt-tmtoNumManually override TMTO value for scrypt to X--scrypt-tmto=3
-s, --skipNumSkip X words from the start-s 1000000
-l, --limitNumLimit X words from the start + skipped words-l 1000000
--keyspaceShow keyspace base:mod values and quit
-j, --rule-leftRuleSingle rule applied to each word from left wordlist-j ‘c’
-k, --rule-rightRuleSingle rule applied to each word from right wordlist-k ‘^-‘
-r, --rules-fileFileMultiple rules applied to each word from wordlists-r rules/best64.rule
-g, --generate-rulesNumGenerate X random rules-g 10000
--generate-rules-func-minNumForce min X functions per rule
--generate-rules-func-maxNumForce max X functions per rule
--generate-rules-seedNumForce RNG seed set to X
-1, --custom-charset1CSUser-defined charset ?1-1 ?l?d?u
-i, --incrementEnable mask increment mode
--increment-minNumStart mask incrementing at X--increment-min=4
--increment-maxNumStop mask incrementing at X--increment-max=8
-S, --slow-candidatesEnable slower (but advanced) candidate generators
--brain-serverEnable brain server
-z, --brain-clientEnable brain client, activates -S
--brain-client-featuresNumDefine brain client features, see below--brain-client-features=3
--brain-hostStrBrain server host (IP or domain)--brain-host=127.0.0.1
--brain-portPortBrain server port--brain-port=13743
--brain-passwordStrBrain server authentication password--brain-password=bZfhCvGUSjRq
--brain-sessionHexOverrides automatically calculated brain session--brain-session=0x2ae611db
--brain-session-whitelistHexAllow given sessions only, separated with commas--brain-session-whitelist=0x2ae611db

掩码破解

掩码规则

BASH

  1. ? | Charset
  2. ===+=========
  3. l | abcdefghijklmnopqrstuvwxyz # 小写字母 a-z
  4. u | ABCDEFGHIJKLMNOPQRSTUVWXYZ # 大写字母 A-Z
  5. d | 0123456789 # 数字 0-9
  6. h | 0123456789abcdef # 数字 + abcdef
  7. H | 0123456789ABCDEF # 数字 + ABCDEF
  8. s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ # 特殊字符
  9. a | ?l?u?d?s # 键盘上所有可见的字符
  10. b | 0x00 - 0xff # 可能是用来匹配像空格这种密码的

自定义掩码规则

BASH

  1. --custom-charset1 [chars]等价于 -1
  2. --custom-charset2 [chars]等价于 -2
  3. --custom-charset3 [chars]等价于 -3
  4. --custom-charset4 [chars]等价于 -4

在掩码中用 ?1?2?3?4 来表示

一些案例:

BASH

--custom-charset1 abcd123456!@-+

此时?1 就表示 abcd123456!@-+

BASH

--custom-charset2 ?l?d

此时?2 就表示 ?l?d 即 ?h 数字 + 小写字母:

BASH

-3 abcdef -4 123456 

此时 ?3?3?3?3?4?4?4?4 就表示为前四位可能是 abcdef,后四位可能是 123456

字典破解

CODE

1q2w3e4r`的MD5值为`5416d7cd6ef195a0f7622a9c56b55e84

BASH

hashcat -a 0 -m 0 '5416d7cd6ef195a0f7622a9c56b55e84' hashpass.txt -o success.txt

删除已破解密码

有时候破解的时候会出现如下提示:

CODE

INFO: All hashes found in potfile! Use --show to display them.

这表明在之前该密码已经被我们破解成功了,Hashcat 故不再显示出来,可以在后面添加参数 --show 来显示密码:

BASH

  1. hashcat -a 0 -m 0 'cbc8f5435c87e13c5d14e6ce92358d68' hashpass.txt --show
  2. cbc8f5435c87e13c5d14e6ce92358d68:123456@abc

Hashcat 存放已经成功破解的密码文件位置为:~/.hashcat/hashcat.potfile

如果想要直接显示破解的密码的话,可以直接删除掉该文件。

批量破解

BASH

  1. # 删除之前破解成功的记录
  2. rm ~/.hashcat/hashcat.potfile
  3. # hash.txt为要破解的密码 hashpass.txt为字典 导出破解的结果到success.txt 并从hash.txt删除掉破解成功的
  4. hashcat -a 0 -m 0 hash.txt hashpass.txt -o success.txt --remove

组合破解

多字典破解

BASH

hashcat -a 1 -m 0 '5416d7cd6ef195a0f7622a9c56b55e84' hashpass1.txt hashpass1.txt

字典 + 掩码破解

BASH

  1. echo -n admin888 |openssl md5
  2. 7fef6171469e80d32c0559f88b377245

破解 admin888 的 MD5 值:

BASH

hashcat -a 6 -m 0 '7fef6171469e80d32c0559f88b377245' hashpass.txt -O

掩码 + 字典破解

BASH

hashcat -a 7 -m 0 '7fef6171469e80d32c0559f88b377245' 'admi?l?d?d?d' hashpass.txt  -O

破解案例

8 位 MD5 加密的数字破解

对 23323323 进行 MD5 加密:

BASH

  1. $ echo -n 23323323 |openssl md5
  2. 5a745e31dbbd93f4c86d1ef82281688b

使用 Hashcat 来进行破解:

BASH

hashcat -a 3 -m 0 --force '5a745e31dbbd93f4c86d1ef82281688b' '?d?d?d?d?d?d?d?d' -O

8 位 MD5 加密的大小写字母破解

BASH

  1. $ echo -n PassWord |openssl md5
  2. a9d402bfcde5792a8b531b3a82669585

使用 Hashcat 来进行破解:

BASH

hashcat -a 3 -m 0 -1 '?l?u' --force  'a9d402bfcde5792a8b531b3a82669585' '?1?1?1?1?1?1?1?1' -O

这里面定义了个自定义规则 -1,此时 ?1 就表示 ?l?u,即大小写字母。

5-7 位 MD5 加密的大小写字母 + 数字破解

Admin88 的 MD5 值为 2792e40d60bac94b4b163b93566e65a9

BASH

hashcat -a 3 -m 0 -1 '?l?u?d' --force  '2792e40d60bac94b4b163b93566e65a9' --increment --increment-min 5 --increment-max 7 '?1?1?1?1?1?1?1' -O

这里面定义了个自定义规则 -1,此时 ?1 就表示 ?l?u?d,即大小写字母 + 数字。

admin 开头 10 位 MD5 加密的大小写字母 + 数字破解

admin23323 的 MD5 值为 a9991129897a44e0d1c2855c3d7dccc4

BASH

hashcat -a 3 -m 0 -1 '?l?u?d' --force  'a9991129897a44e0d1c2855c3d7dccc4' 'admin?1?1?1?1?1' -O

MySQL4.1/MySQL5

查看 MySQL 的密码:

MYSQL

  1. mysql> select Password from mysql.user;
  2. +-------------------------------------------+
  3. | Password |
  4. +-------------------------------------------+
  5. | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
  6. | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
  7. | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
  8. | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
  9. +-------------------------------------------+
  10. 4 rows in set (0.00 sec)

然后开始使用字典破解:

BASH

hashcat -a 0 -m 300 --force '81F5E21E35407D884A6CD4A731AEBFB6AF209E1B' hashpass.txt -O

Linux /etc/shadow sha512crypt $6$, SHA512 (Unix)

查看 /etc/shadow 密码文件:

BASH

  1. root@kali-linux:~# cat /etc/shadow
  2. root:$6$4ojiBMDPrehqrLkX$d2T7Cn8LKkLk4SDXgCh1IEqjhnsUekXaNUXSxiZIwUTndSqyd.9sEcu80sX9DuEHGmHOeoMev2O0ACYtjMett1:18201:0:99999:7:::
  3. daemon:*:18024:0:99999:7:::
  4. bin:*:18024:0:99999:7:::
  5. sys:*:18024:0:99999:7:::
  6. sync:*:18024:0:99999:7:::
  7. games:*:18024:0:99999:7:::
  8. man:*:18024:0:99999:7:::
  9. lp:*:18024:0:99999:7:::
  10. mail:*:18024:0:99999:7:::
  11. news:*:18024:0:99999:7:::
  12. uucp:*:18024:0:99999:7:::
  13. proxy:*:18024:0:99999:7:::
  14. www-data:*:18024:0:99999:7:::
  15. backup:*:18024:0:99999:7:::
  16. list:*:18024:0:99999:7:::
  17. irc:*:18024:0:99999:7:::
  18. gnats:*:18024:0:99999:7:::
  19. nobody:*:18024:0:99999:7:::
  20. _apt:*:18024:0:99999:7:::
  21. systemd-timesync:*:18024:0:99999:7:::
  22. systemd-network:*:18024:0:99999:7:::
  23. systemd-resolve:*:18024:0:99999:7:::
  24. mysql:!:18024:0:99999:7:::
  25. ntp:*:18024:0:99999:7:::
  26. messagebus:*:18024:0:99999:7:::
  27. arpwatch:!:18024:0:99999:7:::
  28. Debian-exim:!:18024:0:99999:7:::
  29. uuidd:*:18024:0:99999:7:::
  30. redsocks:!:18024:0:99999:7:::
  31. tss:*:18024:0:99999:7:::
  32. rwhod:*:18024:0:99999:7:::
  33. iodine:*:18024:0:99999:7:::
  34. miredo:*:18024:0:99999:7:::
  35. dnsmasq:*:18024:0:99999:7:::
  36. postgres:*:18024:0:99999:7:::
  37. usbmux:*:18024:0:99999:7:::
  38. rtkit:*:18024:0:99999:7:::
  39. stunnel4:!:18024:0:99999:7:::
  40. sshd:*:18024:0:99999:7:::
  41. Debian-snmp:!:18024:0:99999:7:::
  42. sslh:!:18024:0:99999:7:::
  43. pulse:*:18024:0:99999:7:::
  44. speech-dispatcher:!:18024:0:99999:7:::
  45. avahi:*:18024:0:99999:7:::
  46. saned:*:18024:0:99999:7:::
  47. inetsim:*:18024:0:99999:7:::
  48. colord:*:18024:0:99999:7:::
  49. geoclue:*:18024:0:99999:7:::
  50. king-phisher:*:18024:0:99999:7:::
  51. Debian-gdm:*:18024:0:99999:7:::
  52. dradis:*:18024:0:99999:7:::
  53. beef-xss:*:18024:0:99999:7:::
  54. systemd-coredump:!!:18082::::::

可以看到 root 是有密码的,前面使用的是 $6 表面 hash 的加密方式为:sha512crypt $6$, SHA512 (Unix)

BASH

  1. # 掩码破解root密码 不在potfile中记录破解成功的hash 指定设备2(核显)来跑密码 并开启优化
  2. hashcat -a 3 -m 1800 --force '$6$4ojiBMDPrehqrLkX$d2T7Cn8LKkLk4SDXgCh1IEqjhnsUekXaNUXSxiZIwUTndSqyd.9sEcu80sX9DuEHGmHOeoMev2O0ACYtjMett1' '?l?l?l?l' -O -d 2 --potfile-disable
  3. # 掩码破解root密码 忽略用户名 不在potfile中记录破解成功的hash 指定设备2(核显)来跑密码 并开启优化
  4. hashcat -a 3 -m 1800 --force 'root:$6$4ojiBMDPrehqrLkX$d2T7Cn8LKkLk4SDXgCh1IEqjhnsUekXaNUXSxiZIwUTndSqyd.9sEcu80sX9DuEHGmHOeoMev2O0ACYtjMett1' '?l?l?l?l' -O -d 2 --username --potfile-disable

macOS 下自带的 CPU 和独显无法破解,这里国光本人手动切换了 -d 2 用核显才成功跑出来:

​编辑

字典破解 Windows LM Hash

BASH

hashcat -a 0 -m 3000 --force '921988ba001dc8e14a3b108f3fa6cb6d' password.txt

字典破解 Windows NTLM Hash

BASH

hashcat -a 0 -m 1000 --force 'e19ccf75ee54e06b06a5907af13cef42' password.txt

分布破解

该功能目前有点坑,现在本地测试还没有顺利成功过,留在这边待以后完善,2021 年了依然没有填这个坑,未来不知道会不会补上…..

参数类型说明国光的理解示例
–brain-serverEnable brain server启用主服务器
-z, –brain-clientEnable brain client, activates -S启用分布式客户端
–brain-client-featuresNumDefine brain client features, see below定义客户端功能–brain-client-features=3
–brain-hostStrBrain server host (IP or domain)主服务器的 IP 或者域–brain-host=127.0.0.1
–brain-portPortBrain server port主服务器端口–brain-port=13743
–brain-passwordStrBrain server authentication password主服务器的认证密码–brain-password=e8acfc7280c48009
–brain-sessionHexOverrides automatically calculated brain session自动覆盖已经计算的主会话–brain-session=0x2ae611db
–brain-session-whitelistHexAllow given sessions only, separated with commas仅允许给定的对话,以逗号分隔–brain-session-whitelist=0x2ae611db

客户端功能

BASH

  1. - [ Brain Client Features ] -
  2. # | Features
  3. ===+========
  4. 1 | Send hashed passwords # 发送已破解的密码
  5. 2 | Send attack positions # 发送已破解的位置
  6. 3 | Send hashed passwords and attack positions # 发送已破解的密码和已破解的位置

声明:本文内容由网友自发贡献,不代表【wpsshop博客】立场,版权归原作者所有,本站不承担相应法律责任。如您发现有侵权的内容,请联系我们。转载请注明出处:https://www.wpsshop.cn/w/我家自动化/article/detail/594964
推荐阅读
相关标签
  

闽ICP备14008679号