Hydra（九头蛇）弱口令爆破工具详解

灰太狼 2022-10-06 00:36 876阅读 0赞

**目录**

1、简介

2、命令

3、安装

4、案例

5、官网

--------------------

## 1、简介 ##

hydra，中文名“九头蛇”，弱口令暴力破解工具，开源，AGPLv3协议。该工具支持多种协议，也支持并行连接，并且经过测试可在 Linux、Windows/Cygwin、Solaris、FreeBSD/OpenBSD、QNX (Blackberry 10) 和 MacOS 上干净地编译。

目前该工具支持以下协议：

Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTPS-POST, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MEMCACHED, MONGODB, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, Radmin, RDP, Rexec, Rlogin, Rsh, RTSP, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.

## 2、命令 ##

Linux下命令语法: 
    	hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [-m MODULE_OPT] [service://server[:PORT][/OPT]]
    
    常用命令：
    	hydra [-l 用户名|–L 用户名文件路径] [-p 密码|–P 密码文件路径] [-t 线程数] [–vV 显示详细信息] [–o 输出文件路径] [–f 找到密码就停止] [–e nsr 空密码和指定密码试探] [ip|-M ip列表文件路径]
    
    参数:
      -R        restore a previous aborted/crashed session
      -I        ignore an existing restore file (don't wait 10 seconds)
      -S        perform an SSL connect
      -s PORT   if the service is on a different default port, define it here
      -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
      -p PASS  or -P FILE  try password PASS, or load several passwords from FILE
      -x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
      -y        disable use of symbols in bruteforce, see above
      -r        use a non-random shuffling method for option -x
      -e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
      -u        loop around users, not passwords (effective! implied with -x)
      -C FILE   colon separated "login:pass" format, instead of -L/-P options
      -M FILE   list of servers to attack, one entry per line, ':' to specify port
      -o FILE   write found login/password pairs to FILE instead of stdout
      -b FORMAT specify the format for the -o FILE: text(default), json, jsonv1
      -f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
      -t TASKS  run TASKS number of connects in parallel per target (default: 16)
      -T TASKS  run TASKS connects in parallel overall (for -M, default: 64)
      -w / -W TIME  wait time for a response (32) / between connects per thread (0)
      -c TIME   wait time per login attempt over all threads (enforces -t 1)
      -4 / -6   use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
      -v / -V / -d  verbose mode / show login+pass for each attempt / debug mode
      -O        use old SSL v2 and v3
      -K        do not redo failed attempts (good for -M mass scanning)
      -q        do not print messages about connection errors
      -U        service module usage details
      -m OPT    options specific for a module, see -U output for information
      -h        more command line options (COMPLETE HELP)
      server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
      service   the service to crack (see below for supported protocols)
      OPT       some service modules support additional input (-U for module help)
    
    支持的services: adam6500 asterisk cisco cisco-enable cvs ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] mssql mysql(v4) nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey teamspeak telnet[s] vmauthd vnc xmpp
    
    使用代理需设置环境变量：HYDRA_PROXY_HTTP or HYDRA_PROXY
    例： % export HYDRA_PROXY=socks5://l:p@127.0.0.1:9150 (or: socks4:// connect://)
         % export HYDRA_PROXY=connect_and_socks_proxylist.txt  (up to 64 entries)
         % export HYDRA_PROXY_HTTP=http://login:pass@proxy:8080
         % export HYDRA_PROXY_HTTP=proxylist.txt  (up to 64 entries)
    
    Examples:
      hydra -l user -P passlist.txt ftp://192.168.0.1
      hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN
      hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
      hydra -l admin -p password ftp://[192.168.0.0/24]/
      hydra -L logins.txt -P pws.txt -M targets.txt ssh

## 3、安装 ##

## 安装命令：
    ./configure [--prefix=指定安装路径]     ## 这步操作可参考哪些服务缺什么依赖
    make
    make install

openssl和ssh依赖项：openssl-devel 和 libssh-devel。

网络通的情况下可直接yum安装：

yum -y install openssl-devel libssh-devel

若内网需要rpm包的情况，也可yum下载rpm包，所必须的依赖也会同时下载：

## windows安装VMvare，在网络通畅情况下，执行如下命令，可下载所用依赖
    yum install --downloadonly --downloaddir=rpm包存放路径
    ## windows下通过ssh登录虚拟机，可避免使用VMvare tools下载文件

rpm忽略依赖强制安装命令：

rpm -ivh *.rpm --nodeps --force

## 4、案例 ##

（1）/tmp/hydra/bin/hydra -l root -p **\*\*** X.X.X.X ssh

![20210610093834808.png][]

（2）/tmp/hydra/bin/hydra -l root -P /tmp/passwd.txt -t 10 -vV -e ns X.X.X.X ssh

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2p3ZW50YW8wMQ_size_16_color_FFFFFF_t_70][]

（3）/tmp/hydra/bin/hydra -l root -P /tmp/passwd.txt -t 10 -vV -e ns -M ip.txt ssh

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2p3ZW50YW8wMQ_size_16_color_FFFFFF_t_70 1][]

## 5、官网 ##

Linux源码地址：[https://github.com/vanhauser-thc/thc-hydra][https_github.com_vanhauser-thc_thc-hydra]

Windows源码地址：[https://github.com/maaaaz/thc-hydra-windows][https_github.com_maaaaz_thc-hydra-windows]

[20210610093834808.png]: /images/20221005/9a39e0592b2845a981dd6eae692ce055.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2p3ZW50YW8wMQ_size_16_color_FFFFFF_t_70]: /images/20221005/0c35d19a65234b0d9122a2d448afd688.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2p3ZW50YW8wMQ_size_16_color_FFFFFF_t_70 1]: /images/20221005/acd5be9eb38f43c99383240fd4777aa0.png
[https_github.com_vanhauser-thc_thc-hydra]: https://github.com/vanhauser-thc/thc-hydra
[https_github.com_maaaaz_thc-hydra-windows]: https://github.com/maaaaz/thc-hydra-windows