Can't crack multiple hashes, only single

[ChronoJim]

I'm experiencing some odd behavior here. When I run a command on a file with a single hash, it works as expected. If I add a second line with a different hash I come up empty - it doesn't even crack the first one. 

I created several test SHA1 salted hashes using test1, test2, etc. I start with one line so my hash file looks like this:

Code:

test1:xxhashxx:xxsaltxx

I run

Code:

cudahashcat60.exe -m 110 -a 3 --username -o test_cracked.txt test.hash test?d

and it cracks it and writes the output to test_cracked.txt as expected. Now I add a second line to the file:

Code:

test1:xxhashxx:xxsaltxx
test2:xxhashxx:xxsaltxx

I run the same command but get no output in the test_cracked.txt file. The command terminates with a Status of exhausted:

Code:

Session.Name...: cudaHashcat
Status.........: Exhausted
Input.Mode.....: Mask (test?d) [5]
Hash.Target....: File (test.hash)
Hash.Type......: sha1($pass.$salt)
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...:        0 H/s
Recovered......: 0/2 (0.00%) Digests, 0/2 (0.00%) Salts
Progress.......: 20/20 (100.00%)
Rejected.......: 0/20 (0.00%)
HWMon.GPU.#1...:  0% Util, 62c Temp, 282rpm Fan

I've tried it with several combinations of hashes, and it always works with one and always fails with more than one. I've checked to make sure there aren't trailing spaces at the end of the lines. Complete newbie here so it's probably something simple that I'm doing wrong, but I've simplified this as much as possible and can't get past it. Any help is appreciated.

[unix-ninja]

Try using Unix-style encoding for newlines and see if that works any better.

[ChronoJim]

Try using Unix-style encoding for newlines and see if that works any better.

Thanks for the suggestion. Tried that (also tried both UTF-8 & ANSI encoding) but I'm getting the same results. FWIW I'm using Notepad++. In an attempt to rule out the file format I copied the MD5 hashes from the example0.hash file and pasted them into my test file and it worked just fine.

[epixoip]

Post your example hashes with the known passwords so we can test.

[ChronoJim]

Post your example hashes with the known passwords so we can test.

Here they are. The known passwords are the same as the usernames (test1, test2...). Format is username/password:hash:salt

Code:

test1:08bb94656c09f3f243f3296e1b7e5e7b9663cf70:868930923161dcffc66dd73e29c33089a200d5e0
test2:f3edb5b912c3ae4724fe5c775db190ed207c50d2:f0fdc7dc4ee4881bd16e85850c221540a84bc6ee
test3:84074e7cf83487f015caa840ff18c7d0bfc9ead0:e1744f80bddd3c5b0256ae7b36e5e503c89c30cf
test4:32c8f8fe3d9d5d2f4c17d2747405ebe4f1677da0:9b73bca0948742f8f6bc6bb595ba0b06964d0f22
test5:e50d6ae2a2cc5a9aa9e5fbe43834a78c5330a2a1:deac8599458f849d72aae889049c030702df9e7f

Thanks for looking into this.

[epixoip]

I can confirm that there is a bug in 2.01, but it looks like it is fixed in beta:

Code:

epixoip@token:~/hashcat-3.00$ ./hashcat64.bin -d 1 -a 3 -m 110 --username --session test_cracked --quiet test.hash test?d
08bb94656c09f3f243f3296e1b7e5e7b9663cf70:868930923161dcffc66dd73e29c33089a200d5e0:test1
32c8f8fe3d9d5d2f4c17d2747405ebe4f1677da0:9b73bca0948742f8f6bc6bb595ba0b06964d0f22:test4
f3edb5b912c3ae4724fe5c775db190ed207c50d2:f0fdc7dc4ee4881bd16e85850c221540a84bc6ee:test2
e50d6ae2a2cc5a9aa9e5fbe43834a78c5330a2a1:deac8599458f849d72aae889049c030702df9e7f:test5
84074e7cf83487f015caa840ff18c7d0bfc9ead0:e1744f80bddd3c5b0256ae7b36e5e503c89c30cf:test3

[atom]

Wouldn't call it a bug, as it was always clear maximum supported salt length is 31. With hashcat v3.00 beta we just increased that length a bit. However, with those hashes with salt length 40, your maximum password length is 15

[ChronoJim]

I can confirm that there is a bug in 2.01, but it looks like it is fixed in beta:

Thanks for the confirmation. Now I can stop beating my head against the wall.

However, with those hashes with salt length 40, your maximum password length is 15

The thing is, it works with salt length 40, but only for a single line. Thanks for the heads up about the 55 character limit, hadn't noticed that.