Base password permutations

So, let's imagine we have a user with a known base password of "Password" and we know the user likes to use 1-4 other numbers or special chars to either append their password, or insert the same range of numbers or special characters randomly WITHIN the root password. Or, potentially, both within and appended, but only a total of 1-4 total 'extra' characters.  

So I've been able to figure out how to append the root password pretty easily using a custom charset with /d /s and incrementing the total length from 9-12, effectively generating 'Password1' through 'Password~~~~', but I can't figure out an equally easy way to do that within the word in order to effectively generate 'P1assword'-'P~~~~assword' through 'Passwor~~~~d' and, ideally, even stuff including both appended and within the word additions, such as 'P1assword~~~' and so on, within those parameters.

Am I missing an easy way to include incremented custom charsets within a known root word?

Something like the iNX function (or maybe the ipX), but with the N incremented, and the X using a custom charset.

FWIW, computationally speaking, this would be to generate a dictionary to use against a slow hash with known salts, but high iterations. 

Thanks!