windows下hashcat使用gpu破解execl打开密码

需要的软件

1.hashcat :https://hashcat.net

2.john the ripper :https://www.openwall.com

获取execl加密文件的Hash

bash 复制代码
PS G:\dl\john-1.9.0-jumbo-1-win64\john-1.9.0-jumbo-1-win64\run> python .\office2john.py .\test6.xlsx
test6.xlsx:$office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3f03f2*cda0e47886401e4baebaa35745788f2c*0fa2f3ce6ce73c772909713c130092e9c7758cf0
PS G:\dl\john-1.9.0-jumbo-1-win64\john-1.9.0-jumbo-1-win64\run>

Office 加密 Offcie 版本对应哈希类型

Office97-03(MD5+RC4,oldoffice0,oldoffice1):-m 9700

Office97-03(0/1, MD5 + RC4, collider #1):-m 9710

Office97-03(0/1, MD5 + RC4, collider #2):-m 9720

Office97-03(3/4, SHA1 + RC4):-m 9800

Office97-03($3, SHA1 + RC4, collider #1):-m9810

Office97-03($3, SHA1 + RC4, collider #2):-m9820

Office2007:-m 9400

Office2010:-m 9500

Office2013:-m 9600

掩码说明

(2)1到8为数字掩码攻击

-a 3 --increment --increment-min 1--increment-max 8 ?d?d?d?d?d?d?d?d --O

?d代表数字,可以换成小写字母?l,大写字母?u,特殊字符?s,大小写字母+特殊字符?a,--O表示最优化破解模式,可以加该参数,也可以不加该参数。

https://cloud.tencent.com/developer/article/1688161

bash 复制代码
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> ./hashcat.exe -m 9400   '$office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3f03f2*cda0e47886401e4baebaa35745788f2c*0fa2f3ce6ce73c772909713c130092e9c7758cf0'  -a 3 ?u?l?l?d?d?d -w 3 -o output.txt
hashcat (v7.0.0) starting

CUDA API (CUDA 13.0)
====================
* Device #01: NVIDIA GeForce RTX 3090 Ti, 23285/24563 MB, 84MCU

OpenCL API (OpenCL 3.0 CUDA 13.0.78) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #02: NVIDIA GeForce RTX 3090 Ti, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 7127 MB (111283 MB free)

The wordlist or mask that you are using is too small.
This means that hashcat cannot use the full parallel power of your device(s).
Hashcat is expecting at least 1978368 base words but only got 34.2% of that.
Unless you supply more work, your cracking speed will drop.
For tips on supplying more work, see: https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.


Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 9400 (MS Office 2007)
Hash.Target......: $office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3...758cf0
Time.Started.....: Fri Aug 15 20:55:02 2025 (7 secs)
Time.Estimated...: Fri Aug 15 20:55:09 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?u?l?l?d?d?d [6]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   403.7 kH/s (33.43ms) @ Accel:23 Loops:1000 Thr:1024 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 2704000/17576000 (15.38%)
Rejected.........: 0/2704000 (0.00%)
Restore.Point....: 0/676000 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:3-4 Iteration:49000-50000
Candidate.Engine.: Device Generator
Candidates.#01...: Aar123 -> Aqx849
Hardware.Mon.#01.: Temp: 70c Fan: 47% Util:100% Core:2040MHz Mem:10251MHz Bus:16

Started: Fri Aug 15 20:54:57 2025
Stopped: Fri Aug 15 20:55:10 2025
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> dir

得到密码Asw352

bash 复制代码
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> more  output.txt
$office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3f03f2*cda0e47886401e4baebaa35745788f2c*0fa2f3ce6ce73c772909713c130092e9c7758cf0:Asw352

PS G:\dl\hashcat-7.0.0\hashcat-7.0.0>

尝试破解9位的密码

bash 复制代码
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> ./hashcat.exe -m 9400   '$office$*2007*20*128*16*101eeac7b750ed0057405812bdbacdf2*6d7433919b8434bfb54355e8768d82e4*e23ba6d66a2740e0cb910aecf4db20eed123166c'  -a 3 ?u?l?l?d?d?d?d?d?d -w 3 -o output.txt
hashcat (v7.0.0) starting

CUDA API (CUDA 13.0)
====================
* Device #01: NVIDIA GeForce RTX 3090 Ti, 23285/24563 MB, 84MCU

OpenCL API (OpenCL 3.0 CUDA 13.0.78) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #02: NVIDIA GeForce RTX 3090 Ti, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 7127 MB (110906 MB free)

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Mode........: 9400 (MS Office 2007)
Hash.Target......: $office$*2007*20*128*16*101eeac7b750ed0057405812bdb...23166c
Time.Started.....: Fri Aug 15 20:49:38 2025 (21 secs)
Time.Estimated...: Sat Aug 16 08:32:01 2025 (11 hours, 42 mins)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?u?l?l?d?d?d?d?d?d [9]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   417.1 kH/s (95.00ms) @ Accel:46 Loops:1000 Thr:512 Vec:1
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 7913472/17576000000 (0.05%)
Rejected.........: 0/7913472 (0.00%)
Restore.Point....: 0/676000000 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:4-5 Iteration:27000-28000
Candidate.Engine.: Device Generator
Candidates.#01...: Car123123 -> Cow709789
Hardware.Mon.#01.: Temp: 83c Fan: 64% Util:100% Core:2010MHz Mem:10251MHz Bus:16

如果是2013版的execl,时间会增加到6天多

bash 复制代码
Host memory allocated for this attack: 4430 MB (111122 MB free)

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Mode........: 9600 (MS Office 2013)
Hash.Target......: $office$*2013*100000*256*16*78632c4de53ac0308cd1a54...db2dd8
Time.Started.....: Fri Aug 15 21:10:42 2025 (9 secs)
Time.Estimated...: Fri Aug 22 09:05:57 2025 (6 days, 11 hours)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?u?l?l?d?d?d?d?d?d [9]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:    31312 H/s (10.38ms) @ Accel:4 Loops:250 Thr:384 Vec:1
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 258048/17576000000 (0.00%)
Rejected.........: 0/258048 (0.00%)
Restore.Point....: 0/676000000 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:2-3 Iteration:3250-3500
Candidate.Engine.: Device Generator
Candidates.#01...: Bar123123 -> Byy166789
Hardware.Mon.#01.: Temp: 70c Fan: 46% Util: 99% Core:2040MHz Mem:10251MHz Bus:16
相关推荐
暮色驶过苍茫3 分钟前
在 Windows 11 上从零复现 3D Gaussian Splatting (3DGS)
windows
Mr成文2 小时前
【usb】windows usb驱动框架简介
windows·stm32·单片机
非凡ghost4 小时前
MediaHuman YouTube to MP3 多语便携版:高效音频提取工具
windows·音视频·软件需求
Su^!-苏释州5 小时前
Windows配置C/C++环境:MinGW+Vscode
c语言·c++·windows·vscode·大一新生学c语言
一点都不方女士6 小时前
.NET Framework 4.0.30319:官方下载与常见问题解决指南
c++·windows·.net·动态链接库·运行库
我的xiaodoujiao6 小时前
Windows系统Web UI自动化测试学习系列3--浏览器驱动下载使用
前端·windows·测试工具·ui
谷咕咕18 小时前
windows下python3,LLaMA-Factory部署以及微调大模型,ollama运行对话,开放api,java,springboot项目调用
java·windows·语言模型·llama
kali-Myon1 天前
解决 win+R 运行处以及文件资源管理器处无法使用 wt、wsl 命令打开终端
windows·wsl·path·regedit·wt
yubo05091 天前
YOLO系列——实时屏幕检测
开发语言·windows·python
火车叼位1 天前
Clink实战指南:让Windows开发者拥有Bash级别的命令行体验
windows