【安全牛学习笔记】离线密码破解、离线密码破解-Hashcat

离线密码破解                                 优势                                             - 离线不会触发密码锁定机制                   - 不会产生大量登录失败日志引起管理员注意 HASH识别工具                                     - hash-identifier                            - Hashid                                     - 可能识别错误或无法识别

通过使用hashid或者Hash-Identifier这种工具来识别哈希类型

工具下载地址：

git clone https://github.com/psypanda/hashid.git

git clone https://github.com/Miserlou/Hash-Identifier.git

root@k:~/Hash-Identifier# ls

Hash_ID.py  README.md

root@k:~/Hash-Identifier# chmod u+x Hash_ID.py   //赋予执行权限

root@k:~/Hash-Identifier# python Hash_ID.py    //打开Hashid

-------------------------------------------------------------------------

 HASH: 5f4dcc3b5aa765d61d8327deb882cf99      //md5加密

Possible Hashs:

[+] MD5

[+] Domain Cashed Credentials . MD4(MD5($pass)).(strtolower($username)))

Least Possible Hashs:

[+]  RAdmin v2.x

[+]  NTLM

[+]  MD4

[+]  MD2

[+]  MD5(HMAC)

[+]  MD4(HMAC)

[+]  MD2(HMAC)

[+]  MD5(HMAC(Wordpress))

[+]  Haval-128

[+]  Haval-128(HMAC)

[+]  RipeMD-128

[+]  RipeMD-128(HMAC)

[+]  SNEFRU-128

[+]  SNEFRU-128(HMAC)

[+]  Tiger-128

[+]  Tiger-128(HMAC)

[+]  md5($pass.$salt)

[+]  md5($salt.$pass)

[+]  md5($salt.$pass.$salt)

[+]  md5($salt.$pass.$username)

[+]  md5($salt.md5($pass))

[+]  md5($salt.md5($pass))

[+]  md5($salt.md5($pass.$salt))

[+]  md5($salt.md5($pass.$salt))

[+]  md5($salt.md5($salt.$pass))

[+]  md5($salt.md5(md5($pass).$salt))

[+]  md5($username.0.$pass)

[+]  md5($username.LF.$pass)

[+]  md5($username.md5($pass).$salt)

[+]  md5(md5($pass))

[+]  md5(md5($pass).$salt)

[+]  md5(md5($pass).md5($salt))

[+]  md5(md5($salt).$pass)

[+]  md5(md5($salt).md5($pass))

[+]  md5(md5($username.$pass).$salt)

[+]  md5(md5(md5($pass)))

[+]  md5(md5(md5(md5($pass))))

[+]  md5(md5(md5(md5(md5($pass)))))

[+]  md5(sha1($pass))

[+]  md5(sha1(md5($pass)))

[+]  md5(sha1(md5(sha1($pass))))

[+]  md5(strtoupper(md5($pass)))

   -------------------------------------------------------------------------

HASH: 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8    //shal加密

Possible Hashs:

[+]  SHA-1

[+]  MySQL5 - SHA-1(SHA-1($pass))

Least Possible Hashs:

[+]  Tiger-160

[+]  Haval-160

[+]  RipeMD-160

[+]  SHA-1(HMAC)

[+]  Tiger-160(HMAC)

[+]  RipeMD-160(HMAC)

[+]  Haval-160(HMAC)

[+]  SHA-1(MaNGOS)

[+]  SHA-1(MaNGOS2)

[+]  sha1($pass.$salt)

[+]  sha1($salt.$pass)

[+]  sha1($salt.md5($pass))

[+]  sha1($salt.md5($pass).$salt)

[+]  sha1($salt.sha1($pass))

[+]  sha1($salt.sha1($salt.sha1($pass)))

[+]  sha1($username.$pass)

[+]  sha1($username.$pass.$salt)

[+]  sha1(md5($pass))

[+]  sha1(md5($pass).$salt)

[+]  sha1(md5(sha1($pass)))

[+]  sha1(sha1($pass))

[+]  sha1(sha1($pass).$salt)

[+]  sha1(sha1($pass).substr($pass,0,3))

[+]  sha1(sha1($salt.$pass))

[+]  sha1(sha1(sha1($pass)))

[+]  sha1(strtolower($username).$pass)

   -------------------------------------------------------------------------

root@K:~# hashid b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86

[+] SHA-512

[+] Whirlpool

[+] Salsa10

[+] Salsa20

[+] SHA3-512

[+] SKein-512

[+] Skein-1024(512)

oot@k:~/hashid# hashid 5f4dcc3b5aa765d61d8327deb882cf99

Analyzing '5f4dcc3b5aa765d61d8327deb882cf99'

[+] MD2 

[+] MD5 

[+] MD4 

[+] Double MD5 

[+] LM 

[+] RIPEMD-128 

[+] Haval-128 

[+] Tiger-128 

[+] Skein-256(128) 

[+] Skein-512(128) 

[+] Lotus Notes/Domino 5 

[+] Skype 

[+] Snefru-128 

[+] NTLM 

[+] Domain Cached Credentials 

[+] Domain Cached Credentials 2 

[+] DNSSEC(NSEC3) 

[+] RAdmin v2.x 

离线密码破解                                   Windows HASH获取工具                               - 利用漏洞: Pwdump、fgdump、mimikatz、wce     - 物理接触: samdump2                           - Kali ISO 启动虚拟机                          - mount /dev/sdal /mnt                         - cd /mnt/Windows/System32/config              - samdump2 SYSTEM SAM -o sam.hash              - 利用nc传输HASH

win7 ip地址： 192.168.1.121

C:\net user w7 1234

命令完成成功！

root@kali:~# fdisk -l    //查看分区

Disk /dev/sha: 80 GiB, 85899345920 bytes, 16772160 sectors

UNits: sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes /512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disklablel type: dos

Disk identifier: 0x6852cbef

Device    Boot  Start      End   Sectors  Size ID Type

/dev/sdal *      2048   206847    204800  100M  7 HPFS/NTFS/exFAX

/dev/sda2      206848 16770111 167563264 79.9G  7 HPFS/NTFS/exFAX

Disk /dev/loop0: 2.4GB, 2556620800 bytes, 4993400 sectors

UNits: sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes /512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

root@kali:~# mount /dev/sha2 /mnt/

root@kali:~# mount /dev/sha2 /media/

root@kali:~# cd /media/

root@kali:/media# ls

Boot  bootmgr  BOOTSECT.BAK  grldr  $RECUELE.BIN  System volume Information

root@kali:/media# cd /mnt/

root@kali:/mnt# ls

Documents and Settings