Quantcast
Channel: hashcat Forum - All Forums
Viewing all 7847 articles
Browse latest View live

Should I be using a rule instead?

$
0
0
Hey all,
I am trying to write a mask of specific length such that involves a possible digit appended similar to this '?l?l?l?l?l?l?d' but a bit more complex, the thing is I would also like all entries without the digit to be brute forced too. Should I just write two separate masks:
Code:
?l?l?l?l?l?l

?l?l?l?l?l?l?d
or is there a way to accomplish this with just a single mask? I know that you can create a custom value character -1 ?l?d but the length of letters needs to be the same. Thank you.

Script or tool for hashing lines needed

$
0
0
I wonder what is the fastest (or at least a fast) way to generate millions of hashes like MD5 and the SHA family (224, 256, 512)? Do you guys know any scripts/tools that will read lines from files, hash each line while taking advantage of GPU, especially CUDA?

A fast solution would be to just read lines with cat and then pipe each line to sha1sum as an example, but maybe there is a faster way to generate hashes using GPU? As far as I know with little CUDA knowledge, we need to read lines from a file with the CPU and copy them to a GPU device and then we can calculate the hash. Maybe there is a way to copy all lines read in one step to the device, which is may be faster. While using CPU only, the copy step is ommited, so maybe the generation process could be faster when we use CPU power instead of GPU power? What do you think?

Unfortunately I can't do a performance analysis on my own since I think there is no option to abuse hashcat as a hash generator (*) and I was not able to find tools that does this exactly.

*really sad, would be a very nice option. I know that hashcat is open source but I don't think it is a one line adjustment in the code to get this option, right?

GPU Utilization stuck at 2%

$
0
0
Hey all,
I've been following multiple guides trying to up my GPU utilization from 2%, I even tried the tips on the hashcat FAQ but none seem to work either raising GPU util by 10% but lowering my H/ or not working at all , my command is:
Code:
./hashcat64.exe -m 500 -o Assignment01 -a 3 -w 4 --force -O --opencl-device-types 1,2 --increment --increment-min 5 .\hard_dump.txt '?a?a?a?a?a?a?a?a?a?a'
can anyone suggest a way to increase my utilization? would adding rules work? thank you

XNMI rule function is not working ?

$
0
0
Hi.
I'm trying to write simpe rule to make conversion like:
Quote:# for 6 length mask 012345 -> 012345345012
M X336 X039

But it seems that functions "M" and "XNMI" are not working.
After start I got:
"Cannot convert rule for use on OpenCL device in file my.rule on line 11: M X336 X039"
Is it a bug or I not understand something ?

100% rejects while using "short words to long" rule

$
0
0
Hi
I've start rule-based attack to WPA using dictionary filled with only 6-chars words (000000-999999).
Rule file consists only in 'd' and 'f' functions so I expect processing 12-chars words only.
But I got 100% rejects, so it seems rules was not applied at all:
Quote:Session..........: hashcat
Status...........: Exhausted
Hash.Type........: WPA-EAPOL-PBKDF2
Hash.Target......: my.hccapx
Time.Started.....: Fri Sep 27 21:54:59 2019 (0 secs)
Time.Estimated...: Fri Sep 27 21:54:59 2019 (0 secs)
Guess.Base.......: File (six.txt)
Guess.Mod........: Rules (my.rule)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:        0 H/s (0.00ms) @ Accel:128 Loops:16 Thr:256 Vec:1
Recovered........: 0/3 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 2000000/2000000 (100.00%)
Rejected.........: 2000000/2000000 (100.00%)
Restore.Point....: 1000000/1000000 (100.00%)
Candidates.#1....: [Copying]

Any ideas ?

Save list

$
0
0
Good Morning.
I need to create a list of possible passwords from a list of names.
but I need to use 1 word min to 3 words max.
Can you help?

Possible words:
Yellow
Blue
green
Purple

saved list
Yellow
Yellowblue
Yellowgreen
YellowPurple
YellowBluePurple
....

Hungarian charset

$
0
0
Why couldn't this simple md5 hash be found by hashcat?
Maybe something important is missing. Thank you.

Code:
echo -n "óóóó" | md5sum

0380d849d5eea725653c91b8c01818c4  -


/usr/local/src/hashcat/charsets/standard/Hungarian/hu_cp1250.hcchr file contains: ÁÉÍÓÕÖÚÛÜáéíóõöúûü

Code:
hashcat -m 0 -a 3 '0380d849d5eea725653c91b8c01818c4' -1 /usr/local/src/hashcat/charsets/standard/Hungarian/hu_cp1250.hcchr ?1?1?1?1

Result: Not found.

Session..........: hashcat                     
Status...........: Exhausted
Hash.Name........: MD5
Hash.Target......: 0380d849d5eea725653c91b8c01818c4
Time.Started.....: Sun Sep 29 13:16:12 2019 (0 secs)
Time.Estimated...: Sun Sep 29 13:16:12 2019 (0 secs)
Guess.Mask.......: ?1?1?1?1 [4]
Guess.Charset....: -1 /usr/local/src/hashcat/charsets/standard/Hungarian/hu_cp1250.hcchr, -2 Undefined, -3 Undefined, -4 Undefined
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  4409.5 kH/s (6.77ms) @ Accel:1024 Loops:18 Thr:1 Vec:4
Recovered........: 0/1 (0.00%) Digests
Progress.........: 104976/104976 (100.00%)
Rejected.........: 0/104976 (0.00%)
Restore.Point....: 5832/5832 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-18 Iteration:0-18
Candidates.#1....: $HEX[e1d5edf3] -> $HEX[fcfbfcfc]

PMKID

$
0
0
Obviously, this shows my ignorance,  but what's the technical reason that you can't pass the PMKID like Pass the hash?

error extracting hash

Custom wordlist

$
0
0
Hello everyone,

my situation is:

I have custom hashes to crack and have wordlist which consist hash:pwd
I want to use bruteforce like if hash from wordlist is in hashes get pwd.
It is possible?

Thank you.

Wordlist consist:
sadea370c6dd1561b440fbee64f916eb:0000
...
4adea370c6c01561b440fbee64f916eb:1246
763c5db11b7c2d48896ac182a102a8c5:4749
93c7d5c26d1f889c5be63957228e1ff5:8351
...

Check attachment.

.txt   hashes.txt (Size: 338 bytes / Downloads: 0)

extract Diskcryptor h4sh

$
0
0
Hello Dears

i have hit by ransomeware , and all my files had encrypted , i found that hashcat :

Support added to crack DiskCryptor (AES) Full-Disk Encryption 100% on GPU. Great contribution from @philsmd


but i didn't able to find clear way to extract the hash from the ecnrypted hdd, i do know that dd command can make backup of the drive but i don't know the right command

you have did amazing effort regarding this issue here :
https://hashcat.net/forum/thread-8012-page-2.html

but it still misisng how to pull the hash !!

kind regards

unknown hash type

Best way to crack emails?

$
0
0
Hi,
PLease share here your hints about cracking emails.
I personanly use :
- facebook names wordlist (left side) + wordlist of email domains (gmail.com, hotmail, etc., right side) using combinator attack
- pure brutoefroce (left side) + wordlist of email domains (gmail.com, hotmail, etc. right side) - very slow.

Both are not very efficient.

Do you have any advices / hints you could share?

Thanks.

WPA2 - 3/4 Digests recovered - Exhausted

$
0
0
Hi,

I'm a little new to hashcat so my apologies if I have mis-understood anything.

I have ran an attack on a wpa2 capture, (single capture) using the mask of 8 uppercase characters. 
At around 75% of the way through I noticed the "Recovered" had changed to Recovered...: 3/4 Digests which I assumed was a good sign that all was good. (note: this could have been 3/4 from the start)
Eventually it completed at 100% but with a status......: exhausted and no output password.

My Questions..
Is this correct and the password wasn't 8 uppercase characters?
What about the 3/4 Digests? I'm of the understanding that this means it has cracked 3 hashes somewhere.
Have I messed the command up somewhere?
Should I have set an output file?

Command used:
Hashcat64.exe -m 2500 -a 3 capture.hccapx ?u?u?u?u?u?u?u?u

Thankyou so much in advance for any help


Output at the end of session.

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: WPA-EAPOL-PBKDF2
Hash.Target......: capture.hccapx
Time.Started.....: Sat Oct 05 23:58:21 2019 (15 hours, 1 min)
Time.Estimated...: Sun Oct 06 14:59:40 2019 (0 secs)
Guess.Mask.......: ?u?u?u?u?u?u?u?u [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:   501.0 kH/s (6.44ms) @ Accel:32 Loops:16 Thr:1024 Vec:1
Speed.#2.........:   497.3 kH/s (6.50ms) @ Accel:32 Loops:16 Thr:1024 Vec:1
Speed.#3.........:   491.5 kH/s (6.55ms) @ Accel:32 Loops:16 Thr:1024 Vec:1
Speed.#*.........:  1489.8 kH/s
Recovered........: 3/4 (75.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 208827064576/208827064576 (100.00%)
Rejected.........: 0/208827064576 (0.00%)
Restore.Point....: 8029988395/8031810176 (99.98%)
Restore.Sub.#1...: Salt:0 Amplifier:25-26 Iteration:3-7
Restore.Sub.#2...: Salt:0 Amplifier:25-26 Iteration:3-7
Restore.Sub.#3...: Salt:0 Amplifier:25-26 Iteration:3-7
Candidates.#1....: XCHMAFQV -> XKHERXFQ
Candidates.#2....: XGTANXFQ -> XQXQFZVQ
Candidates.#3....: XLTLEHQV -> XTECHVQV
Hardware.Mon.#1..: Temp: 39c Fan:  0% Util:  0% Core:1556MHz Mem:5005MHz Bus:8
Hardware.Mon.#2..: Temp: 45c Fan:  0% Util: 91% Core:1898MHz Mem:5005MHz Bus:8
Hardware.Mon.#3..: Temp: 31c Fan:  0% Util:  0% Core: 139MHz Mem: 405MHz Bus:8
Started: Sat Oct 05 23:57:13 2019
Stopped: Sun Oct 06 14:59:42 2019

Hash of office file need to be cracked.

$
0
0
Dear friends,

at first I want to apologize for my poor english.

Maybe somone can help me or can give a good advice.

I friend of mine send me a encrypted office file with a story inside. It's kind of challange.

I extracted the hash with office2john. Now I need to crack the hash to get the story.

I run hashcat with the string:

Code:
hashcat -m 9600 -o cracked -r /usr/share/oclHashcat/rules/best64.rule officepassword

What I get is:

Code:
OpenCL Platform #1: The pocl project
====================================
* Device #1: pthread-AMD Phenom(tm) II X4 965 Processor, 2048/4470 MB allocatable, 4MCU

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 77

Applicable optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.

* Device #1: build_opts '-cl-std=CL1.2 -I OpenCL -I /usr/share/hashcat/OpenCL -D LOCAL_MEM_TYPE=2 -D VENDOR_ID=64 -D CUDA_ARCH=0 -D AMD_ROCM=0 -D VECT_SIZE=4 -D DEVICE_TYPE=2 -D DGST_R0=0 -D DGST_R1=1 -D DGST_R2=2 -D DGST_R3=3 -D DGST_ELEM=4 -D KERN_TYPE=9600 -D _unroll'
Starting attack in stdin mode...

Session..........: hashcat
Status...........: Running
Hash.Type........: MS Office 2013
Hash.Target......: $office$*2013*100000*256*16*0fee92ae708d232d390b7bf...8f0dd4
Time.Started.....: Mon Oct  7 16:55:22 2019 (10 secs)
Time.Estimated...: Mon Oct  7 16:55:32 2019 (0 secs)
Guess.Base.......: Pipe
Guess.Mod........: Rules (/usr/share/oclHashcat/rules/best64.rule)
Speed.#1.........:        0 H/s (0.00ms) @ Accel:64 Loops:64 Thr:1 Vec:4
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 0
Rejected.........: 0
Restore.Point....: 0
Restore.Sub.#1...: Salt:0 Amplifier:0-0 Iteration:0-64
Candidates.#1....: [Copying]

Session..........: hashcat
Status...........: Running
Hash.Type........: MS Office 2013
Hash.Target......: $office$*2013*100000*256*16*0fee92ae708d232d390b7bf...8f0dd4
Time.Started.....: Mon Oct  7 16:55:22 2019 (20 secs)
Time.Estimated...: Mon Oct  7 16:55:42 2019 (0 secs)
Guess.Base.......: Pipe
Guess.Mod........: Rules (/usr/share/oclHashcat/rules/best64.rule)
Speed.#1.........:        0 H/s (0.00ms) @ Accel:64 Loops:64 Thr:1 Vec:4
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 0
Rejected.........: 0
Restore.Point....: 0
Restore.Sub.#1...: Salt:0 Amplifier:0-0 Iteration:0-64
Candidates.#1....: [Copying]

ATTENTION! Read timeout in stdin mode. The password candidates input is too slow:
* Are you sure that you are using the correct attack mode (--attack-mode or -a)?
* Are you sure that you want to use input from standard input (stdin)?
* If so, are you sure that the input from stdin (the pipe) is working correctly and is fast enough?

I assume, that the mistake is on my side. Kann someone help? Where I did the mistake, how I can go further?

With best regards

Katzenjaeger

does not see the second processor 48 cores/ see only 24 cores

$
0
0
there is a computer with 2 processors with a total of 48 cores and 96 threads, but when I run hashcat I see a load on 1 processor, the second one is idle, when testing other applications 2 processors load 100%, tell me how to make it clear that hashcat uses 2 processors, thanks in advance

.jpg   Безымянный.jpg (Size: 469.96 KB / Downloads: 1)

AMD GPU and opencl

$
0
0
Has anyone figured out a way to get an AMD rx 560 gpu with Hashcat ? I have tried using The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) Linux 2019.04, Windows 10 pro, Unbuntu 18.04. I have used the Hashcat tutorials and a lot more on the internet. I have been trying for two weeks and nothing is working. I don't care which OS the help is for just so I can get it to work on one of them. Here are my system specs. if needed.

Architecture:                    x86_64
CPU op-mode(s):                  32-bit, 64-bit
Byte Order:                      Little Endian
Address sizes:                  36 bits physical, 48 bits virtual
CPU(s):                          4
On-line CPU(s) list:            0-3
Thread(s) per core:              1
Core(s) per socket:              4
Socket(s):                      1
NUMA node(s):                    1
Vendor ID:                      GenuineIntel
CPU family:                      6
Model:                          58
Model name:                      Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz
Stepping:                        9
CPU MHz:                        1596.448
CPU max MHz:                    3600.0000
CPU min MHz:                    1600.0000
BogoMIPS:                        6385.55
Virtualization:                  VT-x
L1d cache:                      128 KiB
L1i cache:                      128 KiB
L2 cache:                        1 MiB
L3 cache:                        6 MiB
NUMA node0 CPU(s):              0-3

GPU not utilised

$
0
0
Hi, i am using the latest version of hashcat (v 5.1.0) , I have
Win 10
i5-8300H
Intel(R) UHD Graphics 630 and
NVIDIA GeForce GTX 1050 Ti

Now in Hashcat this seems to be the order

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) UHD Graphics 630, skipped.
* Device #2: Intel(R) Core(TM) i5-8300H CPU @ 2.30GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #3: GeForce GTX 1050 Ti, 1024/4096 MB allocatable, 6MCU




So i use the command
>.\hashcat64 -m 2500 -d 3 try.hccapx D:\hackfiles\testingwpa.txt
i have also tried the same command with " --force " but it dosent seem to work. From the output of the task manager and the status output of hashcat, it looks like only the cpu is being used. here is the output of running 1gb wordlist and its status



>hashcat (v5.1.0) starting...

nvmlDeviceGetFanSpeed(): Not Supported

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) UHD Graphics 630, skipped.
* Device #2: Intel(R) Core(TM) i5-8300H CPU @ 2.30GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #3: GeForce GTX 1050 Ti, 1024/4096 MB allocatable, 6MCU

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Applicable optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63

Watchdog: Temperature abort trigger set to 90c

Dictionary cache hit:
* Filename..: D:\hackfiles\commonwordlists\WPA.txt
* Passwords.: 185866729
* Bytes.....: 2044058553
* Keyspace..: 185866729

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Type........: WPA-EAPOL-PBKDF2
Hash.Target......: Testing (AP:xx:xx:xx:xx:xx:4c STA:xx:xx:xx:xx:68:24)
Time.Started.....: Tue Oct 08 00:02:26 2019 (8 secs)
Time.Estimated...: Tue Oct 08 00:31:39 2019 (29 mins, 5 secs)
Guess.Base.......: File (D:\hackfiles\commonwordlists\WPA.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#3.........:  106.0 kH/s (6.86ms) @ Accel:128 Loops:64 Thr:64 Vec:1
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 835584/185866729 (0.45%)
Rejected.........: 0/835584 (0.00%)
Restore.Point....: 835584/185866729 (0.45%)
Restore.Sub.#3...: Salt:0 Amplifier:0-1 Iteration:2176-2240
Candidates.#3....: aletski70 -> alladeer43
Hardware.Mon.#3..: Temp: 60c Util: 90% Core:1759MHz Mem:3504MHz Bus:16

Cracking performance lower than expected?

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Update your OpenCL runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>


GPU seems to work fine when using other applications and games. anyidea on what to do to make hashcat utilize my gpu fully and not run on cpu ? Thanks in advance.

2080 super vs 2080ti

$
0
0
Hi
I am looking to change my two nvidia 2080ti FE's to evga cards.

But I have a dilemma, I cant decide whether to go for two (with the option to add a 3rd/4th

EVGA GeForce RTX 2080 superFTW3 Ultra Gaming, 8GB GDDR6, ICX2  P4-3287-Kr or two

EVGA GeForce RTX 2080 Ti FTW3 ULTRA GAMING, 11GB GDDR6, iCX2 Technology 11G-P4-2487-KR 

the problem I have is the boost clock on both of these cards the first has a boost clock of 1845mhz
and the second 1755mhz.

The sellers are trying to steer me towards purchasing one 2080ti as apposed to the two supers but either way
I want two of these cards with the option of three.

Now my reasoning is - I will get more bang for my bucks with the two supers (cheaper) than I would with the 
two 2080ti's (dearer).

If anyone has any thoughts/advice/experience related to this post could they please advise.

LUKS clGetEventProfilingInfo(): CL_UNKNOWN_ERROR

$
0
0
(This setup has been stable for several years, never had any problems with hashcat before)


Code:
hashcat64.bin -a 0 -m 14600 LUKS.hash rockyou.txt

hashcat (v5.1.0) starting...

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #2: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #4: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #5: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #6: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #7: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #8: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #9: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU

Then I get several errors like:
clGetEventProfilingInfo(): CL_UNKNOWN_ERROR
clEnqueueReadBuffer(): CL_OUT_OF_RESOURCES


However, if I manually specify the same devices everything works just fine:


Code:
hashcat64.bin -a 0 -m 14600 -d 2,3,4,5,6,7,8,9 LUKS.hash rockyou.txt

hashcat (v5.1.0) starting...

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #2: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #4: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #5: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #6: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #7: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #8: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #9: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU

Using the same syntax for NTLM works fine:


Code:
hashcat64.bin -m 1000 -a 0 ntlm.hash rockyou.txt

hashcat (v5.1.0) starting...

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================
* Device #2: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #4: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #5: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #6: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #7: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #8: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #9: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU

Any idea what is happening here, and how can I debug this further?
Viewing all 7847 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>