Recover passwords in output user:plain

[ABC]

Dear well respected hashcat community members,

I've made a list of hashed passwords in email:hash form that I'd like to recover.

Example:

user129:$H$90C7LZqCAYxRKtymr3ziPBnMLAGFzu.

My question: how do I recover the hashed passwords (in green), leaving the username/email (in red), still intact, so I can make the output like this:

user129:hashcat


I hope this is possible!

Thanks in advance,

ABC

[atom]

hashcat cant do that, oclHashcat-plus can.

[ABC]

And how would I be able to do something like that with oclHashcat-plus, sir?

[atom]

make sure the cracked hashes can be found in hashcat.pot, then use a combination of the --show and --username switches.

[Kakoose]

Hi atom, just a small request from such a proud user, would you please implement this option in hashcat? It would be absolutely wonderful! Unfortunately, I'm not in a position to afford a new computer that is able operate GPU program such as oclHashcat-plus

[atom]

This "feature" should work even without having a GPU. Try it pls and report.

[Kakoose]

Not too sure where you mean, hashcat won't even input (or output), user:hash formats nor is there an option to output user:pass. Maybe I'm not getting what you mean?

[atom]

see here: http://hashcat.net/forum/thread-985-post...ml#pid5037

[drfreddy]

Please, I am very interested in the exact details how to solve this.

I have a db with >100k entries (user:hash); roughly half of which have been de-hashed into a separate file (hash:plain).

How to best proceed to get a user:plain file?

A hashcat.pot file exists, if that's any good.

What would an exact oclhashcat-plus command line be?

Alternatively, can this be achieved with a cleaver find/replace algo in for example Excel or Notepad++?

(And the above posted php solution doesn't work when the lengths of the two input files are mismatched.)

[philsmd]

What you need are following steps (example with mode 0 (md5) of example0.hash):

Code:

$ cat hashtest.hash # some random *X MASKED* hashes from example0.hash
philsmd:42cceb8a0dXXX82b8fb6831f3XXXXXX
drfreddy:27b797965aXXX466041487f2a4XXXXXX
$ cudaHashcat-plus64.exe -t 32 -a 7 hashtest.hash ?a?a?a?a example.dict --username
$ grep 42cceb8a0d hashcat.pot  # to make sure they are in hashcat.pot
$ cudaHashcat-plus64.exe -m 0 hashtest.hash --show --username

It also seems that the forum search returns *SEVERAL* threads about those --show etc options.
For example if you need to reformat it in different ways etc see also: https://hashcat.net/forum/thread-1700.html
Furthermore, hashcat.pot is a plain text file, you can sed/grep/awk etc it as you like, even a simple power shell/sh script can loop over input and hashcat.pot file *very* fast!


The only thing that is a little bit strange to me is that why --outfile-format will *not* be accepted with --show, e.g

Code:

$ cudaHashcat-plus64.exe -m 0 hashtest.hash --outfile-format 2 -o output --show --username

... returns the same output as without --outfile-format

I am sure @atom will say this is *not* a bug, but we can add it as feature request on TRAC, can we/should we?

Best