Discrepancy between Benchmark numbers and actual numbers

[XakEp]

What has me wondering if I'd be better off huffing paint is WHY this command gets such high speeds, but when I correct it, it doesn't get anywhere NEAR the speeds. Same idea with NTLM instead of MD5. Broken command, crazy speeds.

Errors I can see, -a3 and rules are on the left of the pipe. Correcting these drops my speed by an order of magnitude. I feel like I'm 30+ years younger in school and I get the right answer with all of my work being utterly wrong.

hashcat64.exe --stdout d:\wordlists\rockyou.txt -r rules\best64.rule| hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt -O --status --status-timer=2

Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
Hash.Target......: (redacted)
Time.Started.....: Sat Aug 31 13:06:09 2019 (8 secs)
Time.Estimated...: Sat Aug 31 13:06:43 2019 (26 secs)
Guess.Mask.......: ?1?2?2?2?2?2?2?3 [8]
Guess.Charset....: -1 ?l?d?u, -2 ?l?d, -3 ?l?d*!$@_, -4 Undefined
Guess.Queue......: 8/15 (53.33%)
Speed.#1.........: 59420.4 MH/s (4.65ms) @ Accel:64 Loops:512 Thr:256 Vec:2
Speed.#2.........: 44486.6 MH/s (6.81ms) @ Accel:128 Loops:512 Thr:256 Vec:2
Speed.#3.........: 28601.2 MH/s (7.23ms) @ Accel:256 Loops:256 Thr:256 Vec:2
Speed.#4.........: 27482.3 MH/s (5.52ms) @ Accel:128 Loops:256 Thr:256 Vec:2
Speed.#*.........:  160.0 GH/s
Hardware.Mon.#1..: Temp: 44c Fan: 97% Util: 93% Core:2085MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 41c Fan: 44% Util: 96% Core:1936MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 47c Fan: 96% Util: 95% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 47c Fan:100% Util: 95% Core:1429MHz Mem:3304MHz Bus:1

[philsmd]

stdin/pipe only works with -a 0

therefore the command:

Code:

hashcat64.exe --stdout d:\wordlists\rockyou.txt -r rules\best64.rule| hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt -O --status --status-timer=2

is the same as just the right site

Code:

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt -O --status --status-timer=2

well, if -w 2 is faster than -w 3 / -w 4 it might be indeed a problem with your setup. maybe way too little RAM for your system.

Did you try increasing the pagefile/swap to a very large file size ? e.g. additional 32 GB etc

[XakEp]

Random thought, it would be nice to have a benchmark that I could specify the type of attack. Right now, the benchmark command just runs a brute force. Maybe an option for mask, hybrid mask etc so you can see the speeds your setup can do (roughly) against those kinds of attacks. My takeaway from my experience in this thread is to pay less attention to the speeds and more at the Utilization % to determine how efficient my attack is being.

Just random thoughts as I plug away, returning you now to your regularly scheduled programming....

[XakEp]

I'll test that now and post. Thanks!

[XakEp]

Ok so here are the results of the testing -

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt --status --status-timer=2

-w1
Speed.#*.........: 41946.0 MH/s

-w2
Speed.#*.........: 60583.7 MH/s

-w3
Speed.#*.........: 51977.1 MH/s

-w4
Speed.#*.........: 52479.2 MH/s


Playing with the pagefile, it's being Windows so it's a fight to get it RIGHT. I'll post when I have something definitive. I'm tempted to just dual boot to linux and test that to see if I can eliminate the OS as the problem.

I also have a different CPU/MB/RAM combo I can toss in. The MB in there now supports a max of 32GB, but my other board goes much higher, but only has 32GB in it so this is something I can do if needed.

Thanks for the pointers, back to work!

[philsmd]

why did you remove the -O now? it's so confusing to understand what you are testing and why you are changing the hash type and parameters without any reasons. we said that we want to compare it against the other command with 160.0 GH/s with -O enabled

[XakEp]

Because I'm functionally illiterate. Whoops.

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt --status --status-timer=2 -O -w1

Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
...
Speed.#1.........: 49204.5 MH/s (1.31ms) @ Accel:64 Loops:128 Thr:256 Vec:2
Speed.#2.........: 36719.0 MH/s (1.00ms) @ Accel:128 Loops:64 Thr:256 Vec:2
Speed.#3.........: 21160.5 MH/s (0.96ms) @ Accel:128 Loops:64 Thr:256 Vec:2
Speed.#4.........: 22948.1 MH/s (1.45ms) @ Accel:128 Loops:64 Thr:256 Vec:2
Speed.#*.........:  130.0 GH/s
...
Hardware.Mon.#1..: Temp: 48c Fan: 96% Util: 77% Core:2085MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 50c Fan: 44% Util: 81% Core:1949MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 51c Fan:100% Util: 73% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 55c Util: 78% Core:1429MHz Mem:3304MHz Bus:1

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt --status --status-timer=2 -O -w2

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: NTLM
...
Speed.#1.........: 62615.3 MH/s (4.44ms) @ Accel:64 Loops:512 Thr:256 Vec:2
Speed.#2.........: 43056.0 MH/s (7.09ms) @ Accel:128 Loops:512 Thr:256 Vec:2
Speed.#3.........: 28089.0 MH/s (6.73ms) @ Accel:256 Loops:256 Thr:256 Vec:2
Speed.#4.........: 27169.6 MH/s (5.64ms) @ Accel:128 Loops:256 Thr:256 Vec:2
Speed.#*.........:  160.9 GH/s
...
Hardware.Mon.#1..: Temp: 43c Fan: 54% Util: 47% Core:2085MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 39c Fan: 45% Util: 96% Core:1949MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 46c Fan: 45% Util: 96% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 44c Fan: 49% Util: 93% Core:1429MHz Mem:3304MHz Bus:1

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt --status --status-timer=2 -O -w3

Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
...
Speed.#1.........: 61241.0 MH/s (7.73ms) @ Accel:64 Loops:1024 Thr:256 Vec:2
Speed.#2.........: 32586.6 MH/s (11.27ms) @ Accel:128 Loops:1024 Thr:256 Vec:2
Speed.#3.........: 27758.6 MH/s (21.59ms) @ Accel:256 Loops:1024 Thr:256 Vec:2
Speed.#4.........: 20564.1 MH/s (16.43ms) @ Accel:128 Loops:1024 Thr:256 Vec:2
Speed.#*.........:  142.2 GH/s
...
Hardware.Mon.#1..: Temp: 49c Fan: 96% Util: 95% Core:2085MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 44c Fan: 45% Util: 67% Core:1949MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 53c Fan:100% Util: 89% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 50c Fan:100% Util: 71% Core:1429MHz Mem:3304MHz Bus:1

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt --status --status-timer=2 -O -w4

Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
...
Speed.#1.........: 61154.3 MH/s (7.73ms) @ Accel:64 Loops:1024 Thr:256 Vec:2
Speed.#2.........: 32731.5 MH/s (11.26ms) @ Accel:128 Loops:1024 Thr:256 Vec:2
Speed.#3.........: 27768.5 MH/s (21.58ms) @ Accel:256 Loops:1024 Thr:256 Vec:2
Speed.#4.........: 20499.3 MH/s (16.43ms) @ Accel:128 Loops:1024 Thr:256 Vec:2
Speed.#*.........:  142.2 GH/s
...
Hardware.Mon.#1..: Temp: 49c Fan: 97% Util: 95% Core:2085MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 44c Fan: 45% Util: 67% Core:1936MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 53c Fan: 99% Util: 91% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 49c Util: 71% Core:1429MHz Mem:3304MHz Bus:1

For comparison -

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt --status --status-timer=2 -O

Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
...
Speed.#1.........: 59515.3 MH/s (4.63ms) @ Accel:64 Loops:512 Thr:256 Vec:2
Speed.#2.........: 44679.1 MH/s (6.85ms) @ Accel:128 Loops:512 Thr:256 Vec:2
Speed.#3.........: 28794.1 MH/s (7.24ms) @ Accel:256 Loops:256 Thr:256 Vec:2
Speed.#4.........: 27488.9 MH/s (5.54ms) @ Accel:128 Loops:256 Thr:256 Vec:2
Speed.#*.........:  160.5 GH/s
...
Hardware.Mon.#1..: Temp: 46c Fan: 97% Util: 93% Core:2100MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 42c Fan: 44% Util: 96% Core:1923MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 49c Fan: 99% Util: 94% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 49c Fan:100% Util: 94% Core:1429MHz Mem:3304MHz Bus:1

hashcat64.exe -b -m1000

Hashmode: 1000 - NTLM

Speed.#1.........: 71914.1 MH/s (10.24ms) @ Accel:64 Loops:1024 Thr:256 Vec:2
Speed.#2.........: 57573.6 MH/s (15.65ms) @ Accel:128 Loops:1024 Thr:256 Vec:2
Speed.#3.........: 33308.8 MH/s (29.46ms) @ Accel:256 Loops:1024 Thr:256 Vec:2
Speed.#4.........: 31428.7 MH/s (22.87ms) @ Accel:128 Loops:1024 Thr:256 Vec:2
Speed.#*.........:  194.2 GH/s

It looks like I get the best of both words using the combination of -O and -w2, any other workload value drops performance. I'll be honest, I've learned a lot dinking with this, I'll keep at it.

Why would -w2 give the best performance over 3 or 4? If the issue is "my system", what do you think I should be looking at? Obviously I'll do the heavy lifting, but your thoughts (random or not) on this will help give me a direction to dig into.

[XakEp]

Update time!

Ok, so here is current performance against NTLM - 

hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt -O ?a?a?a?a?a?a?a?a -i -w2

Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
Hash.Target......: (redacted)
Time.Started.....: Sun Sep 01 15:59:30 2019 (6 secs)
Time.Estimated...: Sun Sep 01 16:05:54 2019 (6 mins, 18 secs)
Guess.Mask.......: ?a?a?a?a?a?a?a [7]
Speed.#1.........: 67634.0 MH/s (4.98ms) @ Accel:64 Loops:512 Thr:256 Vec:2
Speed.#2.........: 53203.9 MH/s (7.62ms) @ Accel:128 Loops:512 Thr:256 Vec:2
Speed.#3.........: 31264.8 MH/s (7.21ms) @ Accel:256 Loops:256 Thr:256 Vec:2
Speed.#4.........: 29104.7 MH/s (5.63ms) @ Accel:128 Loops:256 Thr:256 Vec:2
Speed.#*.........:  181.2 GH/s
Hardware.Mon.#1..: Temp: 53c Fan: 98% Util: 92% Core:2085MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 51c Fan: 48% Util: 95% Core:1923MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 56c Util: 94% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 56c Util: 93% Core:1429MHz Mem:3304MHz Bus:1

I've found that for whatever reason, against NTLM and MD5 hashes I consistently get the best performance using -w2 and -O. If I use -w1, 3 or 4 the numbers are either a bit lower or a LOT lower. No idea why. I tested this against SHA2-256 and some other hashes (fast and slow) and found -w to work as intended, so -w 4 was always the fastest.

Things I also tried but seemed to make no difference - I set the pagefile larger, in increments of 10GB from 10GB to 100GB, no change. I put NVME drives in and tried those, both running hashcat off them and moving the pagefile to them from the SATA SSD, no change. The observed RAM and pagefile consumption by Windows did not change, and did not increase at all. I never observed more than 12GB consumption between RAM and pagefile utilization or commit, so I'm not thinking I'm hitting an issue with only 32GB of RAM but I'm certainly not ruling it out either. The hashcat64.exe process never directly consumed more than 1.9GB of memory that I observed, even after running it overnight against slow or fast hashes.

The only other thing I did was go into my BIOS and tinker with my CPU/PCI speed settings, but after making those changes no improvement to hashcat was observed. The speeds started going WAY up when I was changing to -w2 and using -O at the same time.

*shrug*

It's close enough to the benchmarks that I'm happy with the results, and now I'm working on improving my methodology using hashcat to crack hashes. I'd like to say thank you to y'all for putting up with me, I hope my posts in this thread help some poor soul in the future who runs into something strange like this.

Hashcat is an incredible tool, and getting better at it is something I have put off for too long. Time to dig in!

[Kryczek]

Try each card separately?

[XakEp]

Try each card separately?

Top of page three, already did.