1
import hashlib
2
import string
3
import random
4

5
PASSWORD_LENGTH = 4
6
CHARSET = string.ascii_lowercase
7
CHAIN_LENGTH = 400
8
NUM_CHAINS = 4000
9

10
def hash_function(text):
11
    return hashlib.md5(text.encode('utf-8')).hexdigest()
12

13
# 写一个归约函数
14
def reduction_func(hash_v,index):
15
    inthash = int(hash_v,16)
16
    inthash += index
17
    password = ""
18

19
    for _ in range(PASSWORD_LENGTH):
20
        password += CHARSET[inthash % len(CHARSET)]
21
        inthash //= len(CHARSET)
22
    return password
23

24
def generate_rainbow_table():
25
    print("=====生成彩虹表=====")
26
    rainbow_table = {}
27
    for i in range(NUM_CHAINS):
28
        # 初始密码
29
        start_password = ''.join(random.choice(CHARSET) for _ in range(PASSWORD_LENGTH))
30
        current_password = start_password
31
        for j in range(CHAIN_LENGTH):
32
            hash_val = hash_function(current_password)
33
            current_password = reduction_func(hash_val,j)
34

35
        end_hash = hash_function(current_password)
36

37
        rainbow_table[start_password] = end_hash
38
        if (i + 1) % (NUM_CHAINS // 10) == 0:
39
            print(f"已生成 {i + 1}/{NUM_CHAINS} 条链...")
40

41
    print("=====彩虹表生成完毕=====")
42
    return rainbow_table
43

44
def crack_password(target_hash, rainbow_table):
45
    """尝试使用彩虹表破解给定的哈希"""
46
    print(f"--- 目标哈希: {target_hash} ---")
47
    print("--- 开始破解... ---")
48

49
    # 阶段一：查找链条
50
    # 从链的末端开始，逐个位置向前尝试
51
    for i in range(CHAIN_LENGTH - 1, -1, -1):
52
        temp_hash = target_hash
53

54
        # 从目标哈希开始，执行 R->H 操作，直到链的末端
55
        for j in range(i, CHAIN_LENGTH):
56
            password = reduction_func(temp_hash, j)
57
            temp_hash = hash_function(password)
58

59
        # 检查计算出的最终哈希是否存在于彩虹表中
60
        for start_password, end_hash in rainbow_table.items():
61
            if temp_hash == end_hash:
62
                print(f"匹配成功！哈希可能在以 '{start_password}' 开头的链中。")
63

64
                # 阶段二：验证并找到密码
65
                # 从找到的链的起点开始，重现整条链
66
                current_password = start_password
67
                for k in range(CHAIN_LENGTH):
68
                    current_hash = hash_function(current_password)
69
                    if current_hash == target_hash:
70
                        # 找到了！
71
                        print(f"\n*** 破解成功！密码是: {current_password} ***")
72
                        return current_password
73
                    # 继续链的下一个环节
74
                    current_password = reduction_func(current_hash, k)
75

76
    print("\n--- 破解失败，密码不在彩虹表中。 ---")
77
    return None
78

79

80

81
if __name__ == "__main__":
82
    rainbow_table = generate_rainbow_table()
83

84
    original_password = "love"
85
    target_hash_to_crack = hash_function(original_password)
86

87
    crack_password(target_hash_to_crack,rainbow_table)
88

89
    print("完成！！！")

1
import hashlib
2
import os
3

4
def salted_hash(password,salt:str=None):
5
    if salt is None:
6
        salt = os.urandom(16).hex()
7
    hash_val = hashlib.sha256((password + salt).encode()).hexdigest()
8
    return hash_val, salt
9

10
if __name__ == "__main__":
11
    pwd = "bx33661"
12
    hash_val, salt = salted_hash(pwd)
13
    print("保存的哈希:", hash_val)
14
    print("保存的盐  :", salt)
15

16
    # 验证
17
    hash_val_check, _ = salted_hash(pwd, salt)
18
    print("验证结果:", hash_val == hash_val_check)

1
"C:\Program Files\Python312\python.exe" C:\Users\bx336\Desktop\HTB\ntlm\rainbow\salt_hash.py
2
保存的哈希: da59c617b69f5ef217777810700934d9e6b89013a705aa14062d33148a66a103
3
保存的盐  : c1d1b85839f14eed150da0c94e1bd8bf
4
验证结果: True
5

6
进程已结束，退出代码为 0

1
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 1 /f