一、驗證不能通過修改用戶的password實現登錄不知道密碼的用戶
[oracle@node1 ~]$ sqlplus / as sysdba SQL*Plus: Release 11.2.0.3.0 Production on Mon Nov 7 12:22:46 2011 Copyright (c) 1982, 2011, Oracle. All rights reserved. Connected to:Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit ProductionWith the Partitioning, Oracle Label Security, OLAP, Data Mining,Oracle Database Vault and Real Application
Testing options SQL> grant create session to xff
identified by xifenfei; Grant succeeded. SQL> conn xff/xifenfeiConnected.SQL> conn / as sysdbaConnected.SQL> grant create session to chf
identified by xifenfei; Grant succeeded. SQL> conn chf/xifenfeiConnected. SQL> conn / as sysdbaConnected.SQL> desc user$ Name Null?
Type ----------------------------------------- -------- ---------------------------- USER# NOT NULL NUMBER NAME NOT NULL VARCHAR2(30) TYPE# NOT NULL NUMBER PASSWORD VARCHAR2(30) DATATS# NOT NULL NUMBER TEMPTS# NOT NULL NUMBER CTIME NOT NULL DATE PTIME DATE EXPTIME DATE LTIME DATE RESOURCE$ NOT NULL NUMBER AUDIT$ VARCHAR2(38) DEFROLE NOT NULL NUMBER DEFGRP# NUMBER DEFGRP_SEQ# NUMBER ASTATUS NOT NULL NUMBER LCOUNT NOT NULL NUMBER DEFSCHCLASS VARCHAR2(30) EXT_USERNAME VARCHAR2(4000) SPARE1 NUMBER SPARE2 NUMBER SPARE3 NUMBER SPARE4 VARCHAR2(1000) SPARE5 VARCHAR2(1000) SPARE6 DATE SQL> select name,password from user$ where name in('XFF','CHF'); NAME PASSWORD------------------------------ ------------------------------CHF F3CF2F0CB35CB6CAXFF 1B60F4BFF1DAB500 SQL> alter user xff
identified by values 'F3CF2F0CB35CB6CA'; User altered. SQL> select name,password from user$ where name in('XFF','CHF'); NAME PASSWORD------------------------------ ------------------------------CHF F3CF2F0CB35CB6CAXFF F3CF2F0CB35CB6CA SQL> conn xff/xifenfeiERROR:ORA-01017: 用戶名/口令無效; 登錄被拒絕 Warning: You are no longer connected to ORACLE.SQL> conn chf/xifenfeiConnected. SQL> conn / as sysdbaConnected.SQL> alter user xff
identified by values '1B60F4BFF1DAB500'; User altered. SQL> conn xff/xifenfeiConnected. |
注：這個實驗使用11g證明，其實10g也是同樣的結果；在Oracle 9i中可以通過修改password的values值實現登錄
二、使用orabf破解數據庫密碼
1、修改數據庫密碼
SQL> conn / as sysdbaConnected.SQL> alter user xff
identified by xff01; User altered. SQL> alter user chf
identified by chf00; User altered. SQL> select name,password from user$ where name in('XFF','CHF'); NAME PASSWORD------------------------------ ------------------------------CHF 05BD6F8AB28BD8CAXFF A51B3879056B3DDD |
2、orabf使用
C:\Users\XIFENFEI\Downloads\orabf-v0.7.6>orabf orabf v0.7.6, (C)2005 [email protected]--------------------------------------- usage: orabf [hash]:[username] [options] options:-c [num] complexity: a number in [1..6] or a filename - read words from stdin [file] read words
from file 1 numbers 2 alpha 3 alphanum 4 standard oracle (alpha)(alpha,num,_,#,$)... (default) 5 entire keyspace (' '..'~') 6 custom (charset read from first line of file:
charset.orabf)-m [num] max pwd len: must be in the
interval [1..14] (default: 14)-n [num] min pwd len: must be in the
interval [1..14] (default: 1)-r resume: tries to resume a previous session C:\Users\XIFENFEI\Downloads\orabf-v0.7.6>orabf A51B3879056B3DDD:XFF orabf v0.7.6, (C)2005 [email protected]---------------------------------------Trying default passwords...done Starting brute force session using charset:#$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_ press 'q' to quit. any other key to see status current password: D9X509229361 passwords tried. elapsed time 00:00:13. t/s:697938 current password: HI0QJ18967617 passwords tried. elapsed time 00:00:27. t/s:698403 current password: OB#QD34743632 passwords tried. elapsed time 00:00:49. t/s:698844 password found: XFF:XFF01 55826385 passwords tried. elapsed time 00:01:19. t/s:704047 C:\Users\XIFENFEI\Downloads\orabf-v0.7.6>orabf 05BD6F8AB28BD8CA:CHF -c 3 -n 4 -m 6 orabf v0.7.6, (C)2005 [email protected]---------------------------------------Trying default passwords...done Starting brute force session using charset:0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ press 'q' to quit. any other key to see status password found: CHF:CHF00 22647601 passwords tried. elapsed time 00:00:31. t/s:719113 |
說明：-c 6不能正常運行，不清楚是不是因爲我的win 7系統原因導致
三、使用ops_sse2破解數據庫密碼
1、sys用戶的password
SQL> select password from user$ where name='SYS'; PASSWORD------------------------------18698BFD1A045BCC |
2、ops_sse2使用
C:\Users\XIFENFEI\Downloads\ops_SIMD_win32>ops_sse2Oracle passwords (DES) solver 0.3 (SSE2) -- Dennis Yurichev <[email protected]>Compiled @ Apr 5 2011 12:13:15Demo version, supporting only SYS usernames.Usage: ops_sse2.exe --hashlist=filename.txt [--min=min_password_length] [--max=max_password_length] [--first_symbol_charset=characters] [--charset=characters] [--results=filename.txt] hashlist file format:username:hash:comment_or_SID By default, results are dumped to stdout.This can be changed by setting --results option Default values: min_password_length=1 max_password_length=8 first_symbol_charset=ABCDEFGHIJKLMNOPQRSTUVWXYZ charset=ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789#$_ #ops_file.txt內容SYS:18698BFD1A045BCC:xff C:\Users\XIFENFEI\Downloads\ops_SIMD_win32>ops_sse2 --hashlist=ops_file.txt --min=6 --charset=CDEFNHITXOracle passwords (DES) solver 0.3 (SSE2) -- Dennis Yurichev <[email protected]>Compiled @ Apr 5 2011 12:13:15Demo version, supporting only SYS usernames.username=SYS: 1 unsolved hash(es) leftChecking 6-symbol passwords for username SYSoverall progress= 0%username=SYS: 1 unsolved hash(es) leftChecking 7-symbol passwords for username SYSoverall progress= 98% / time remaining:time elapsed: 12s, ~ 1160449 passwords/hashes per
secondusername=SYS: 1 unsolved hash(es) leftChecking 8-symbol passwords for username SYSoverall progress= 91% / time remaining: 8stime elapsed: 1m31s, ~ 1248875 passwords/hashes per
secondSYS/xff: Found password: XIFENFEISYS:XIFENFEI:xff |
說明：Demo version只能使用於破解sys用戶的密碼，而且祕密長度不能超過8.
綜合說明的試驗，雖然都有缺陷，但是相對而已還是orabf破解更加的給力點