[20171214]hashcat破解oracle口令.txt

hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for
over 200 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on
Linux, Windows, and OSX, and has facilities to help enable distributed password cracking.

--//hashcat號稱最快的破解程式,支援CPU,GPU.本人也不是搞資料庫安全的,自己也測試看看oracle口令破解:

1.環境:

SCOTT@book> @ &r/ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.4.0 Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production

SCOTT@book> column spare4 format a62
SCOTT@book> select NAME,SPARE4,PASSWORD from sys.user$ where name='SCOTT';
NAME SPARE4 PASSWORD
-------------------- -------------------------------------------------------------- ------------------------------
SCOTT S:960B7BCEF95E6A3F4F0E828726D4FA3D2A6EDCD526510491A3524AFA2913 0EDE56329E1D82EA

2.下載hashcat軟體:
--//下載地址:hashcat.net/hashcat/
--//說明:我下載當前版本4.0.1在windows與linux機器都無法執行.
--//在windows下報如下錯誤:
R:\hashcat-4.0.1>hashcat64.exe -t 32 -a 7 example0.hash ?a?a?a?a example.dict --force
hashcat (v4.0.1) starting...

clGetDeviceInfo(): CL_INVALID_VALUE

Started: Fri Dec 15 09:00:01 2017
Stopped: Fri Dec 15 09:00:02 2017
--//linux下g報lib版本太低.放棄在linux的測試:
# ./hashcat64.bin
./hashcat64.bin: /lib64/libc.so.6: version `GLIBC_2.14' not found (required by ./hashcat64.bin)
./hashcat64.bin: /lib64/libc.so.6: version `GLIBC_2.15' not found (required by ./hashcat64.bin)

--//最終我選擇v3.00的版本.也是最低的版本.但是在linux依舊glib版本太低,只能在windows下測試.(注我不想升級glib在linux下,主要
--//害怕出問題).

3.測試oracle 7+口令的破解:
--//先看看hashcat64.exe --help,命令列真複雜,這是我看到最複雜命令列程式,不過它支援的破解也是最全的軟體.我僅僅測試oracle口
--//令的破解:

--//oracle 7-10g:
--//oracle 7-10g口令要包括使用者名稱+口令

--//建立檔案a.hash:
R:\hashcat>cat a.hash
0EDE56329E1D82EA:SCOTT

R:\hashcat>hashcat64.exe -m 3100 a.hash example.dict
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU

ATTENTION! Unsupported or incorrectly installed Catalyst driver detected!
You are STRONGLY encouraged to use the official supported catalyst driver
See hashcat's homepage for official supported catalyst drivers
Also see:
You can use --force to override this but do not post error reports if you do so
--//說明:可能是我顯示卡版本驅動太低,不支援一些特性,必須加--force,估計不能使用gpu解密..^_^.

R:\hashcat>hashcat64.exe -m 3100 a.hash example.dict --force
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped

WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled

- Device #1: Kernel m03100_a0.2258b51f.kernel not found in cache! Building may take a while...
Generated dictionary stats for example.dict: 1080240 bytes, 129988 words, 129988 keyspace

0EDE56329E1D82EA:SCOTT:BOOK
--//破解成功,另外破解的口令儲存在hashcat.pot檔案.下次執行不會破解.我這裡為了測試需要,每次測試前都刪除這個檔案.

Session.Name...: hashcat
Status.........: Cracked
Input.Mode.....: File (example.dict)
Hash.Target....: 0EDE56329E1D82EA:SCOTT
Hash.Type......: Oracle H: Type (Oracle 7+)
Time.Started...: 0 secs
Speed.Dev.#1...: 4542.9 kH/s (11.07ms)
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 75264/129988 (57.90%)
Rejected.......: 0/75264 (0.00%)
Restore.Point..: 0/129988 (0.00%)

Started: Thu Dec 14 15:18:28 2017
Stopped: Thu Dec 14 15:18:40 2017

4.測試oracle 11g口令破解:
--//我在這裡卡了一下,實際上要滿足hash檔案的格式要求,在加密串與slot之間加入冒號分割.

--//建立檔案如下,oracle11g的口令後面20位作為slot,要在加密串偏移40的位置加入冒號,建立文字如下:
R:\hashcat>cat b.hash
960B7BCEF95E6A3F4F0E828726D4FA3D2A6EDCD5:26510491A3524AFA2913

--//2種方式都可以破解
--//-m 110 必須加引數--hex-salt ,至少我這個版本這樣.
--//-m 112 也支援(說明:上一些論壇,說hashcat不支援-m 112引數.)

R:\hashcat>hashcat64.exe -m 110 --hex-salt b.hash exam.dict --force
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped

WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Precompute-Init
* Precompute-Merkle-Demgard
* Early-Skip
* Not-Iterated
* Appended-Salt
* Single-Hash
* Single-Salt
* Raw-Hash
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled

- Device #1: Kernel m00110_a0.2258b51f.kernel not found in cache! Building may take a while...
--//這裡很慢,等待2-3分鐘...第2次執行就不會這樣慢了.為此我建立了1個小字典檔案,好像時間也沒有變化.
Generated dictionary stats for exam.dict: 6 bytes, 1 words, 1 keyspace

ATTENTION!
The wordlist or mask you are using is too small.
Therefore, hashcat is unable to utilize the full parallelization power of your device(s).
The cracking speed will drop.
Workaround:

INFO: approaching final keyspace, workload adjusted

960b7bcef95e6a3f4f0e828726d4fa3d2a6edcd5:26510491a3524afa2913:book

Session.Name...: hashcat
Status.........: Cracked
Input.Mode.....: File (exam.dict)
Hash.Target....: 960b7bcef95e6a3f4f0e828726d4fa3d2a6edcd5:...
Hash.Type......: sha1($pass.$salt)
Time.Started...: 0 secs
Speed.Dev.#1...: 0 H/s (0.18ms)
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 1/1 (100.00%)
Rejected.......: 0/1 (0.00%)

Started: Thu Dec 14 16:07:13 2017
Stopped: Thu Dec 14 16:09:40 2017

--//會在kernels目錄建立一些檔案
R:\hashcat>dir kernels\*
驅動器 R 中的卷是 RAMDISK
卷的序列號是 0122-14E0

R:\hashcat\kernels 的目錄

2017/12/15 08:44    <DIR>          .
2017/12/15 08:44    <DIR>          ..
2017/12/14 16:19           390,240 amp_a0.2258b51f.kernel
2017/12/14 16:05         2,111,020 m00000_a0.2258b51f.kernel
2017/12/14 16:09         2,837,428 m00110_a0.2258b51f.kernel
2017/12/15 08:44           807,128 m00110_a3.2258b51f.kernel
2017/12/14 16:19           433,952 m00500.2258b51f.kernel
2017/12/14 15:18           977,440 m03100_a0.2258b51f.kernel
2017/12/14 15:25           977,440 m03100_a0.d9e822e7.kernel
2017/12/15 08:44            50,808 markov_be.2258b51f.kernel
               8 個檔案      8,585,456 位元組
               2 個目錄    716,163,072 可用位元組

--//我在linux下看檔案格式視乎是一些執行檔案:
# file amp_a0.2258b51f.kernel
amp_a0.2258b51f.kernel: ELF 32-bit LSB executable, version 1 (SYSV), corrupted program header size, not stripped
# file m03100_a0.2258b51f.kernel
m03100_a0.2258b51f.kernel: ELF 32-bit LSB executable, version 1 (SYSV), corrupted program header size, not stripped

--//使用-m 112引數測試,注意測試前刪除hashcat.pot,不然什麼也不做-m 112加不加--hex-salt都可以破解:
hashcat64.exe -m 112 b.hash example.dict --force
hashcat64.exe -m 112 --hex-salt b.hash example.dict --force

R:\hashcat>hashcat64.exe -m 112 --hex-salt b.hash example.dict --force
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped

WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Precompute-Init
* Precompute-Merkle-Demgard
* Early-Skip
* Not-Iterated
* Appended-Salt
* Single-Hash
* Single-Salt
* Raw-Hash
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled

Cache-hit dictionary stats example.dict: 1080240 bytes, 129988 words, 129988 keyspace

960b7bcef95e6a3f4f0e828726d4fa3d2a6edcd5:26510491a3524afa2913:book

Session.Name...: hashcat
Status.........: Cracked
Input.Mode.....: File (example.dict)
Hash.Target....: 960b7bcef95e6a3f4f0e828726d4fa3d2a6edcd5:...
Hash.Type......: Oracle S: Type (Oracle 11+)
Time.Started...: 0 secs
Speed.Dev.#1...: 2849.4 kH/s (11.79ms)
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 64512/129988 (49.63%)
Rejected.......: 0/64512 (0.00%)
Restore.Point..: 0/129988 (0.00%)

Started: Fri Dec 15 09:26:36 2017
Stopped: Fri Dec 15 09:26:38 2017

5.補充linux服務起口令如何破解:
--//實際上這個破解主要了解-m後面的引數,linux的口令應該是500.
500 | Cisco-IOS $1$ | Operating-Systems

$1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5.
--//注意後面的點(在我測試是必須的,不是多餘的字元,原來的口令加密串就有這個點,我開始測試少了這個點,老是報錯)
R:\hashcat>hashcat64 -m 500 l.hash example.dict --force
hashcat (v3.00-1-g67a8d97) starting...
WARNING: Hashfile 'l.hash' on line 1 ($1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5): Hash-length exception
Parsed Hashes: 1/1 (100.00%)
ERROR: No hashes loaded
--//關於linux口令可以參考連線:http://blog.itpub.net/267265/viewspace-2084794/
--//建立檔案l.hash.

R:\hashcat>cat l.hash
$1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5.

R:\hashcat>hashcat64 -m 500 l.hash exam.dict --force
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped

WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled

Generated dictionary stats for exam.dict: 14 bytes, 2 words, 2 keyspace

ATTENTION!
The wordlist or mask you are using is too small.
Therefore, hashcat is unable to utilize the full parallelization power of your device(s).
The cracking speed will drop.
Workaround:

INFO: approaching final keyspace, workload adjusted

$1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5.:123456

Session.Name...: hashcat
Status.........: Cracked
Input.Mode.....: File (exam.dict)
Hash.Target....: $1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5.
Hash.Type......: md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5
Time.Started...: 0 secs
Speed.Dev.#1...: 0 H/s (6.51ms)
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 2/2 (100.00%)
Rejected.......: 0/2 (0.00%)

Started: Thu Dec 14 16:20:43 2017
Stopped: Thu Dec 14 16:20:46 2017

--//hash值也可以直接寫在命令列,例子:
R:\hashcat>hashcat64 -m 500 $1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5. example.dict --force
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped

WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled

Cache-hit dictionary stats example.dict: 1080240 bytes, 129988 words, 129988 keyspace

$1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5.:123456

Session.Name...: hashcat
Status.........: Cracked
Input.Mode.....: File (example.dict)
Hash.Target....: $1$ZcwH7AWX$0BlZZRahwsQ4hLIEUTBN5.
Hash.Type......: md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5
Time.Started...: 0 secs
Speed.Dev.#1...: 121.9 kH/s (10.09ms)
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 6144/129988 (4.73%)
Rejected.......: 0/6144 (0.00%)
Restore.Point..: 4608/129988 (3.54%)

Started: Fri Dec 15 09:35:04 2017
Stopped: Fri Dec 15 09:35:06 2017

6.總結:
--//實際上hashcat很複雜,支援許多引數,各種口令的變化組合.許多知識點是我的空白,我僅僅學習如何使用.
--//建立大家建立資料庫口令.至少拿這些軟體檢檢視看,不要找一個口令幾分鐘就crack.^_^.

--//補充一些測試與學習:
hashcat64 --help

- [ Attack Modes ] -
--//-a 引數

- [ Built-in Charsets ] -

? | Charset
===+=========
l | abcdefghijklmnopqrstuvwxyz
u | ABCDEFGHIJKLMNOPQRSTUVWXYZ
d | 0123456789
s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
a | ?l?u?d?s
b | 0x00 - 0xff

--"

- [ Basic Examples ] -

--//奇怪破解linux口令不支援字符集操作.視乎不能與-m引數結合在一起.
R:\hashcat>hashcat64 -a 0 -m 500 l.hash example.dict ?d?d?d?d?d?d --force
hashcat (v3.00-1-g67a8d97) starting...
OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped

WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled
ERROR: ?d?d?d?d?d?d: No such file or directory

R:\hashcat>hashcat64 -t 32 -a 7 -m 500 l.hash example.dict ?a?a?a?a --force
hashcat (v3.00-1-g67a8d97) starting...
OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped
WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Applicable Optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled
ERROR: ?a?a?a?a: No such file or directory
--//不知道這種 ?a?a 如何使用.

--//測試md5字串的破解:
# echo -n 1a2b3c | md5sum
bf4ab447496f2d3d5a6c77c2cd12f996 -

--//注意這裡echo 引數-n是必須的,避免回車字元.另外不要在windwos下執行,不知道為什麼windows與linux結果不同.
R:\hashcat>echo -n 1a2b3c | md5sum
1e1a52ad526995f5ae0f51d9bdbff204 *-

R:\hashcat>cat z.hash
bf4ab447496f2d3d5a6c77c2cd12f996

R:\hashcat>hashcat64 z.hash example.dict --force
hashcat (v3.00-1-g67a8d97) starting...
OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped
WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Precompute-Init
* Precompute-Merkle-Demgard
* Meet-In-The-Middle
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled
Cache-hit dictionary stats example.dict: 1080240 bytes, 129988 words, 129988 keyspace
ATTENTION!
The wordlist or mask you are using is too small.
Therefore, hashcat is unable to utilize the full parallelization power of your device(s).
The cracking speed will drop.
Workaround:

INFO: approaching final keyspace, workload adjusted

bf4ab447496f2d3d5a6c77c2cd12f996:1a2b3c

Session.Name...: hashcat
Status.........: Cracked
Input.Mode.....: File (example.dict)
Hash.Target....: bf4ab447496f2d3d5a6c77c2cd12f996
Hash.Type......: MD5
Time.Started...: 0 secs
Speed.Dev.#1...: 10589.1 kH/s (6.52ms)
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 129988/129988 (100.00%)
Rejected.......: 0/129988 (0.00%)

Started: Fri Dec 15 10:25:21 2017
Stopped: Fri Dec 15 10:25:23 2017

--//如果我修改如下,使用example.dict就無法破解要加入其它引數才行.
# echo -n 1a2B3c | md5sum
cf57cddc51ae1c171b69e7f333e398a7 -

R:\hashcat>hashcat64 -m 0 cf57cddc51ae1c171b69e7f333e398a7 example.dict --force
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Advanced Micro Devices, Inc.
================================================
- Device #1: Turks, 766/1024 MB allocatable, 6MCU
- Device #2: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, skipped

WARNING: ADL_Overdrive6_TargetTemperatureData_Get is missing from ADL shared library.
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable Optimizers:
* Zero-Byte
* Precompute-Init
* Precompute-Merkle-Demgard
* Meet-In-The-Middle
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled

Cache-hit dictionary stats example.dict: 1080240 bytes, 129988 words, 129988 keyspace

ATTENTION!
The wordlist or mask you are using is too small.
Therefore, hashcat is unable to utilize the full parallelization power of your device(s).
The cracking speed will drop.
Workaround:

INFO: approaching final keyspace, workload adjusted

Session.Name...: hashcat
Status.........: Exhausted
Input.Mode.....: File (example.dict)
Hash.Target....: 349a62b7eb59892d7a06dfa37c0128db
Hash.Type......: MD5
Time.Started...: 0 secs
Speed.Dev.#1...: 17978.3 kH/s (6.46ms)
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 129988/129988 (100.00%)
Rejected.......: 0/129988 (0.00%)

Started: Fri Dec 15 10:52:55 2017
Stopped: Fri Dec 15 10:52:57 2017

--//我在linux下使用john就很快.
$ john --format=raw-md5 z.txt
Loaded 1 password hash (Raw MD5 [SSE2i 10x4x3])
1a2B3c (?)
guesses: 1 time: 0:00:00:03 DONE (Fri Dec 15 11:04:08 2017) c/s: 7436K trying: 16lk60 - 1a2BOG
Use the "--show" option to display all of the cracked passwords reliably

[20171214]hashcat破解oracle口令.txt

相關文章