windows下hashcat使用gpu破解execl打开密码

需要的软件

1.hashcat :https://hashcat.net

2.john the ripper :https://www.openwall.com

获取execl加密文件的Hash

bash 复制代码
PS G:\dl\john-1.9.0-jumbo-1-win64\john-1.9.0-jumbo-1-win64\run> python .\office2john.py .\test6.xlsx
test6.xlsx:$office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3f03f2*cda0e47886401e4baebaa35745788f2c*0fa2f3ce6ce73c772909713c130092e9c7758cf0
PS G:\dl\john-1.9.0-jumbo-1-win64\john-1.9.0-jumbo-1-win64\run>

Office 加密 Offcie 版本对应哈希类型

Office97-03(MD5+RC4,oldoffice0,oldoffice1):-m 9700

Office97-03(0/1, MD5 + RC4, collider #1):-m 9710

Office97-03(0/1, MD5 + RC4, collider #2):-m 9720

Office97-03(3/4, SHA1 + RC4):-m 9800

Office97-03($3, SHA1 + RC4, collider #1):-m9810

Office97-03($3, SHA1 + RC4, collider #2):-m9820

Office2007:-m 9400

Office2010:-m 9500

Office2013:-m 9600

掩码说明

(2)1到8为数字掩码攻击

-a 3 --increment --increment-min 1--increment-max 8 ?d?d?d?d?d?d?d?d --O

?d代表数字,可以换成小写字母?l,大写字母?u,特殊字符?s,大小写字母+特殊字符?a,--O表示最优化破解模式,可以加该参数,也可以不加该参数。

https://cloud.tencent.com/developer/article/1688161

bash 复制代码
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> ./hashcat.exe -m 9400   '$office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3f03f2*cda0e47886401e4baebaa35745788f2c*0fa2f3ce6ce73c772909713c130092e9c7758cf0'  -a 3 ?u?l?l?d?d?d -w 3 -o output.txt
hashcat (v7.0.0) starting

CUDA API (CUDA 13.0)
====================
* Device #01: NVIDIA GeForce RTX 3090 Ti, 23285/24563 MB, 84MCU

OpenCL API (OpenCL 3.0 CUDA 13.0.78) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #02: NVIDIA GeForce RTX 3090 Ti, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 7127 MB (111283 MB free)

The wordlist or mask that you are using is too small.
This means that hashcat cannot use the full parallel power of your device(s).
Hashcat is expecting at least 1978368 base words but only got 34.2% of that.
Unless you supply more work, your cracking speed will drop.
For tips on supplying more work, see: https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.


Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 9400 (MS Office 2007)
Hash.Target......: $office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3...758cf0
Time.Started.....: Fri Aug 15 20:55:02 2025 (7 secs)
Time.Estimated...: Fri Aug 15 20:55:09 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?u?l?l?d?d?d [6]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   403.7 kH/s (33.43ms) @ Accel:23 Loops:1000 Thr:1024 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 2704000/17576000 (15.38%)
Rejected.........: 0/2704000 (0.00%)
Restore.Point....: 0/676000 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:3-4 Iteration:49000-50000
Candidate.Engine.: Device Generator
Candidates.#01...: Aar123 -> Aqx849
Hardware.Mon.#01.: Temp: 70c Fan: 47% Util:100% Core:2040MHz Mem:10251MHz Bus:16

Started: Fri Aug 15 20:54:57 2025
Stopped: Fri Aug 15 20:55:10 2025
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> dir

得到密码Asw352

bash 复制代码
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> more  output.txt
$office$*2007*20*128*16*84626bdea7e63ec8ca1144a4ea3f03f2*cda0e47886401e4baebaa35745788f2c*0fa2f3ce6ce73c772909713c130092e9c7758cf0:Asw352

PS G:\dl\hashcat-7.0.0\hashcat-7.0.0>

尝试破解9位的密码

bash 复制代码
PS G:\dl\hashcat-7.0.0\hashcat-7.0.0> ./hashcat.exe -m 9400   '$office$*2007*20*128*16*101eeac7b750ed0057405812bdbacdf2*6d7433919b8434bfb54355e8768d82e4*e23ba6d66a2740e0cb910aecf4db20eed123166c'  -a 3 ?u?l?l?d?d?d?d?d?d -w 3 -o output.txt
hashcat (v7.0.0) starting

CUDA API (CUDA 13.0)
====================
* Device #01: NVIDIA GeForce RTX 3090 Ti, 23285/24563 MB, 84MCU

OpenCL API (OpenCL 3.0 CUDA 13.0.78) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #02: NVIDIA GeForce RTX 3090 Ti, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 7127 MB (110906 MB free)

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Mode........: 9400 (MS Office 2007)
Hash.Target......: $office$*2007*20*128*16*101eeac7b750ed0057405812bdb...23166c
Time.Started.....: Fri Aug 15 20:49:38 2025 (21 secs)
Time.Estimated...: Sat Aug 16 08:32:01 2025 (11 hours, 42 mins)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?u?l?l?d?d?d?d?d?d [9]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   417.1 kH/s (95.00ms) @ Accel:46 Loops:1000 Thr:512 Vec:1
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 7913472/17576000000 (0.05%)
Rejected.........: 0/7913472 (0.00%)
Restore.Point....: 0/676000000 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:4-5 Iteration:27000-28000
Candidate.Engine.: Device Generator
Candidates.#01...: Car123123 -> Cow709789
Hardware.Mon.#01.: Temp: 83c Fan: 64% Util:100% Core:2010MHz Mem:10251MHz Bus:16

如果是2013版的execl,时间会增加到6天多

bash 复制代码
Host memory allocated for this attack: 4430 MB (111122 MB free)

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Mode........: 9600 (MS Office 2013)
Hash.Target......: $office$*2013*100000*256*16*78632c4de53ac0308cd1a54...db2dd8
Time.Started.....: Fri Aug 15 21:10:42 2025 (9 secs)
Time.Estimated...: Fri Aug 22 09:05:57 2025 (6 days, 11 hours)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?u?l?l?d?d?d?d?d?d [9]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:    31312 H/s (10.38ms) @ Accel:4 Loops:250 Thr:384 Vec:1
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 258048/17576000000 (0.00%)
Rejected.........: 0/258048 (0.00%)
Restore.Point....: 0/676000000 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:2-3 Iteration:3250-3500
Candidate.Engine.: Device Generator
Candidates.#01...: Bar123123 -> Byy166789
Hardware.Mon.#01.: Temp: 70c Fan: 46% Util: 99% Core:2040MHz Mem:10251MHz Bus:16
相关推荐
love530love6 小时前
【保姆级教程】阿里 Wan2.1-T2V-14B 模型本地部署全流程:从环境配置到视频生成(附避坑指南)
人工智能·windows·python·开源·大模型·github·音视频
Chukai1237 小时前
Windows 和 Linux 系统下修改防火墙机制开放端口
linux·运维·windows
IT小农工9 小时前
Windows 文件资源管理器无法预览文件内容word、ppt、excel、pdf
windows·word·powerpoint
要记得喝水11 小时前
C#某公司面试题(含题目和解析)--1
开发语言·windows·面试·c#·.net
小韩博14 小时前
Windows 权限提升(一)
windows
魔都吴所谓16 小时前
【Python】根据开始时间、结束时间计算中间时间
开发语言·windows·python
syty202017 小时前
flink 伪代码
java·windows·flink
IDOlaoluo18 小时前
TortoiseGit 2.4.0.0 64位安装教程(附详细步骤和Git配置 附安装包)
windows
知行力18 小时前
【GitHub每日速递】不止 TeamViewer 替代!RustDesk 与 PowerToys,Windows 效率神器
windows·github·teamviewer
怒码ing19 小时前
List<?>和List<Object>区别
windows·python·list