need batch stop after pass found hccapx

need batch stop after pass found hccapx - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: need batch stop after pass found hccapx (/thread-8910.html)

Pages: 1 2

RE: need batch stop after pass found hccapx - ZerBea - 01-28-2020

(01-28-2020, 03:58 PM)msalman Wrote: the pass is in my first wordlist
11223344

The attached hccapx file is a multi hash file. It contain 15 hashes (6 of them are dupes). If one of them is not recovered, hashcat will exhaust!

Code:
$ hashcat -m 2500 hamza.hccapx -a 3 11223344

hashcat (v5.1.0-1628-g424a6ee8) starting...

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

Session..........: hashcat

Status...........: Exhausted

Hash.Name........: WPA-EAPOL-PBKDF2

Hash.Target......: hamza.hccapx

Time.Started.....: Tue Jan 28 15:39:03 2020 (0 secs)

Time.Estimated...: Tue Jan 28 15:39:03 2020 (0 secs)

Guess.Mask.......: 11223344 [8]

Guess.Queue......: 1/1 (100.00%)

Speed.#1.........:      41 H/s (0.71ms) @ Accel:8 Loops:128 Thr:1024 Vec:1

Recovered........: 4/9 (44.44%) Digests

Progress.........: 1/1 (100.00%)

Rejected.........: 0/1 (0.00%)

Restore.Point....: 1/1 (100.00%)

Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:8-17

Candidates.#1....: 11223344 -> 11223344

Hardware.Mon.#1..: Temp: 60c Fan: 48% Util: 53% Core:1860MHz Mem:5005MHz Bus:16

Started: Tue Jan 28 15:38:59 2020

Stopped: Tue Jan 28 15:39:05 2020

only 4 of 9 are recoverable running hashcat default options.

But all of them are recoverable by activating nonce-error-corrections:

Code:
$ hashcat -m 2500 --nonce-error-corrections=128 hamza.hccapx -a 3 11223344

hashcat (v5.1.0-1628-g424a6ee8) starting...

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344  

Session..........: hashcat

Status...........: Cracked

Hash.Name........: WPA-EAPOL-PBKDF2

Hash.Target......: hamza.hccapx

Time.Started.....: Tue Jan 28 15:41:30 2020 (0 secs)

Time.Estimated...: Tue Jan 28 15:41:30 2020 (0 secs)

Guess.Mask.......: 11223344 [8]

Guess.Queue......: 1/1 (100.00%)

Speed.#1.........:      11 H/s (0.71ms) @ Accel:8 Loops:128 Thr:1024 Vec:1

Recovered........: 9/9 (100.00%) Digests

Progress.........: 1/1 (100.00%)

Rejected.........: 0/1 (0.00%)

Restore.Point....: 0/1 (0.00%)

Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:8-17

Candidates.#1....: 11223344 -> 11223344

Hardware.Mon.#1..: Temp: 57c Fan: 43% Util: 63% Core:1860MHz Mem:5005MHz Bus:16

Started: Tue Jan 28 15:41:26 2020

Stopped: Tue Jan 28 15:41:32 2020

Which tool did you use to capture the traffic?
Which tool did you use to convert the handshakes?
Can you please attach the cap file?

RE: need batch stop after pass found hccapx - msalman - 02-01-2020

i have used ka li and air o dump and then i have used hashcat online converter but i only capture one bssid then why it have multi hashes i dont understand!!
should i use this --nonce-error-corrections=128 in my batch ?
cap link
https://gofile.io/?c=OKhbbD

RE: need batch stop after pass found hccapx - ZerBea - 02-01-2020

hashcat online converter run cap2hccapx from hashcat-utils.
You should know that cap2hccapx will convert more than one hash to the hccapx file. Therefore it takes every good message pair and convert it:

Code:
$ ./cap2hccapx.bin ptcl_l2-test-01.cap test.hccapx

Networks detected: 1

[*] BSSID=c8:3a:35:57:d2:d1 ESSID=PTCL_L2 290 (Length: 11)

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=5

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=5

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=5

 --> STA=a8:51:5b:2b:34:52, Message Pair=2, Replay Counter=5

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=9

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=9

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=9

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=9

 --> STA=a8:51:5b:2b:34:52, Message Pair=2, Replay Counter=9

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=13

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=13

 --> STA=a8:51:5b:2b:34:52, Message Pair=2, Replay Counter=13

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=13

 --> STA=a8:51:5b:2b:34:52, Message Pair=0, Replay Counter=0

 --> STA=a8:51:5b:2b:34:52, Message Pair=2, Replay Counter=0

Written 15 WPA Handshakes to: test.hccapx

Result is a single hccapx file that contain 15 hashes from your BSSID!

I noticed that you ran airodump-ng in combination with aireplay-ng to deauthenticate the client. In that case you must expect a packet loss, because neither aireplay-ng (active part) nor airodump-ng (passive part) request missing packets. Additional your cap file contain many, many useless frames.
Also, you have made much noise on the channel to get a few hashes:
DEAUTHENTICATION (total).................: 10779 !!!!!!!!!!!!!

Code:
$ hcxpcapngtool -o test.22000 ptcl_l2-test-01.cap

reading from ptcl_l2-test-01.cap...

summary capture file

--------------------

file name................................: ptcl_l2-test-01.cap

version (pcap/cap).......................: 2.4 (very basic format without any additional information)

timestamp minimum (GMT)..................: 22.01.2020 23:09:00

timestamp maximum (GMT)..................: 22.01.2020 23:11:52

link layer header type...................: DLT_IEEE802_11 (105)

endianess (capture system)...............: little endian

packets inside...........................: 70694

BEACON (total)...........................: 1

PROBEREQUEST (directed)..................: 17

PROBERESONSE.............................: 574

DEAUTHENTICATION (total).................: 10779

DISASSOCIATION (total)...................: 4

AUTHENTICATION (total)...................: 30

AUTHENTICATION (OPEN SYSTEM).............: 30

ASSOCIATIONREQUEST (total)...............: 7

ASSOCIATIONREQUEST (PSK).................: 7

REASSOCIATIONREQUEST (total).............: 6

REASSOCIATIONREQUEST (PSK)...............: 6

WPA encrypted............................: 17929

EAPOL messages (total)...................: 275

EAPOL RSN messages.......................: 275

ESSID (total unique).....................: 1

EAPOLTIME gap (measured maximum usec)....: 518630

REPLAYCOUNT gap (measured maximum).......: 23

EAPOL M1 messages........................: 264

EAPOL M2 messages........................: 4

EAPOL M3 messages........................: 5

EAPOL M4 messages........................: 2

EAPOL pairs (total)......................: 26

EAPOL pairs (best).......................: 1

EAPOL pairs written to combi hash file...: 1 (RC checked)

EAPOL M12E2..............................: 1

PMKID (total)............................: 270

PMKID (best).............................: 3

PMKID written to combi hash file.........: 3

Using the new hashline (hashmode -m 22000), you will get three PMKIDs and one EAPOL messagepair :
EAPOL pairs written to combi hash file...: 1 (RC checked)
PMKID (best).............................: 3

Code:
WPA*01*6ad4d529d74c755225770588504731d0*c83a3557d2d1*a8515b2b3452*5054434c5f4c3220323930***

WPA*01*ac60b839f81746454d2bb743973b70c1*c83a3557d2d1*b072bf54a97b*5054434c5f4c3220323930***

WPA*01*21210939fda7e65a095426fb43ef8c7a*c83a3557d2d1*e4a7c5915cf1*5054434c5f4c3220323930***

WPA*02*83388eaca56640cb56e87a5527fe11e2*c83a3557d2d1*a8515b2b3452*5054434c5f4c3220323930*949c91f6e9732a5e036b962b6a4c8332705b8deedffbd58f8929082c410a3e70*0103007502010a0000000000000000000df98bbc1103e2852cbd86968b713e0d3063c30dc60df02b5a840e91e63d260172000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac020100000fac040100000fac022c24*00

If you take a closer look at the converted hashes, you'll notice that hcacpangtool converted different "best" hashes (a PMKID send from the access point to every CLIENTS and an EAPOL messagepair).
Running hashcat against them will recover the PSK quickly (and without any additional options):

Code:
$ hashcat -m 22000 test.22000 -a 3 11223344

hashcat (v5.1.0-1633-g346637ec) starting...

21210939fda7e65a095426fb43ef8c7a:c83a3557d2d1:e4a7c5915cf1:PTCL_L2 290:11223344

6ad4d529d74c755225770588504731d0:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

ac60b839f81746454d2bb743973b70c1:c83a3557d2d1:b072bf54a97b:PTCL_L2 290:11223344

83388eaca56640cb56e87a5527fe11e2:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

Session..........: hashcat

Status...........: Cracked

Hash.Name........: WPA-PBKDF2-PMKID+EAPOL

Hash.Target......: test.22000

Time.Started.....: Sat Feb  1 20:32:39 2020 (0 secs)

Time.Estimated...: Sat Feb  1 20:32:39 2020 (0 secs)

Guess.Mask.......: 11223344 [8]

Guess.Queue......: 1/1 (100.00%)

Speed.#1.........:       39 H/s (0.70ms) @ Accel:8 Loops:128 Thr:1024 Vec:1

Recovered........: 4/4 (100.00%) Digests

Progress.........: 1/1 (100.00%)

Rejected.........: 0/1 (0.00%)

Restore.Point....: 0/1 (0.00%)

Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:3-7

Candidates.#1....: 11223344 -> 11223344

Hardware.Mon.#1..: Temp: 55c Fan: 35% Util: 55% Core:1873MHz Mem:5005MHz Bus:16

Started: Sat Feb  1 20:32:34 2020

Stopped: Sat Feb  1 20:32:41 2020

Three times from the PMKID and one time from the EAPOL messagepair.

BTW:
You may have noticed that the new hashline is HEX-ASCII. You can use simple bash commands to show it, to sort it and to remove unwanted hashes.
A single PMKID is more than enough to recover the PSK. You can remove the other hashes.

should I use this --nonce-error-corrections=128 in my batch ?
-> that question isn't easy to answer, because it depend on the tools you use to atttack the network, to capture the traffic, to convert the hash and to recover the PSK.
But hcxpcangtool will help you a little bit to choose the nonce-error-corrections values. This is the measured value between the lowest replaycount and the highest replaycount:
REPLAYCOUNT gap (measured maximum).......: 23
Always, you can use this value for hashcat nonce-error-corrections to be on the safe side.
Running hcxdumptool to attack and capture, hcxpcapngtool to convert and latest hashcat to recover the PSKs will give you good results and less noise on the channel (PMKID attack: https://hashcat.net/forum/thread-7717.html).
If you have a PMKID, use it (hashcat old hashmode -m 16800 or hashcat new hashmode -m 22000). Don't waste your GPU time on EAPOL messagepairs (unless you like to discover the secrets of an unauthorized M2).
If you retrieve the PMKID by hand (Wireshark), keep in mind that it can be calculated using a zeroed PMK!
If you run hcxpcapngtool, you will be informed and this kind of PMKID will not be not converted:
PMKID (over zeroed PMK)..................: 1

Additional hcxhashtool will give you an information about the ACCESS POINT, the CLIENT and the state of the authentication:

Code:
$ hcxhashtool -i test.22000 --info=stdout

SSID.......: PTCL_L2 290

MAC_AP.....: c83a3557d2d1 (Tenda Technology Co., Ltd.)

MAC_CLIENT.: a8515b2b3452 (Samsung Electronics Co.,Ltd)

PMKID......: 6ad4d529d74c755225770588504731d0

HASHLINE...: WPA*01*6ad4d529d74c755225770588504731d0*c83a3557d2d1*a8515b2b3452*5054434c5f4c3220323930***

SSID.......: PTCL_L2 290

MAC_AP.....: c83a3557d2d1 (Tenda Technology Co., Ltd.)

MAC_CLIENT.: b072bf54a97b (Murata Manufacturing Co., Ltd.)

PMKID......: ac60b839f81746454d2bb743973b70c1

HASHLINE...: WPA*01*ac60b839f81746454d2bb743973b70c1*c83a3557d2d1*b072bf54a97b*5054434c5f4c3220323930***

SSID.......: PTCL_L2 290

MAC_AP.....: c83a3557d2d1 (Tenda Technology Co., Ltd.)

MAC_CLIENT.: e4a7c5915cf1 (HUAWEI TECHNOLOGIES CO.,LTD)

PMKID......: 21210939fda7e65a095426fb43ef8c7a

HASHLINE...: WPA*01*21210939fda7e65a095426fb43ef8c7a*c83a3557d2d1*e4a7c5915cf1*5054434c5f4c3220323930***

SSID.......: PTCL_L2 290

MAC_AP.....: c83a3557d2d1 (Tenda Technology Co., Ltd.)

MAC_CLIENT.: a8515b2b3452 (Samsung Electronics Co.,Ltd)

VERSION....: 802.1X-2001 (1)

KEY VERSION: WPA2

REPLAYCOUNT: 13

RC INFO....: replycount checked

MP M1M2 E2.: not authorized

MIC........: 83388eaca56640cb56e87a5527fe11e2

HASHLINE...: WPA*02*83388eaca56640cb56e87a5527fe11e2*c83a3557d2d1*a8515b2b3452*5054434c5f4c3220323930*949c91f6e9732a5e036b962b6a4c8332705b8deedffbd58f8929082c410a3e70*0103007502010a0000000000000000000df98bbc1103e2852cbd86968b713e0d3063c30dc60df02b5a840e91e63d260172000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac020100000fac040100000fac022c24*00

And even if you decide to convert all(!) hashes, your attempt will be successful:

Code:
$ hcxpcapngtool --all -o test.22000 ptcl_l2-test-01.cap

reading from ptcl_l2-test-01.cap...

summary capture file

--------------------

file name................................: ptcl_l2-test-01.cap

version (pcap/cap).......................: 2.4 (very basic format without any additional information)

timestamp minimum (GMT)..................: 22.01.2020 23:09:00

timestamp maximum (GMT)..................: 22.01.2020 23:11:52

link layer header type...................: DLT_IEEE802_11 (105)

endianess (capture system)...............: little endian

packets inside...........................: 70694

BEACON (total)...........................: 1

PROBEREQUEST (directed)..................: 17

PROBERESONSE.............................: 574

DEAUTHENTICATION (total).................: 10779

DISASSOCIATION (total)...................: 4

AUTHENTICATION (total)...................: 30

AUTHENTICATION (OPEN SYSTEM).............: 30

ASSOCIATIONREQUEST (total)...............: 7

ASSOCIATIONREQUEST (PSK).................: 7

REASSOCIATIONREQUEST (total).............: 6

REASSOCIATIONREQUEST (PSK)...............: 6

WPA encrypted............................: 17929

EAPOL messages (total)...................: 275

EAPOL RSN messages.......................: 275

ESSID (total unique).....................: 1

EAPOLTIME gap (measured maximum usec)....: 518630

REPLAYCOUNT gap (measured maximum).......: 23

EAPOL M1 messages........................: 264

EAPOL M2 messages........................: 4

EAPOL M3 messages........................: 5

EAPOL M4 messages........................: 2

EAPOL pairs (total)......................: 26

EAPOL pairs (best).......................: 26

EAPOL pairs written to combi hash file...: 26 (RC checked)

EAPOL M12E2..............................: 22

EAPOL M32E2..............................: 4

PMKID (total)............................: 270

PMKID (best).............................: 270

PMKID written to combi hash file.........: 270

$ hashcat -m 22000 test.22000 --nonce-error-corrections=8 -a 3 11223344

hashcat (v5.1.0-1633-g346637ec) starting...

2356d59821bb6d62813c41a375951f77:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

2596f54e999999f40e18dcad30662816:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

21210939fda7e65a095426fb43ef8c7a:c83a3557d2d1:e4a7c5915cf1:PTCL_L2 290:11223344

6ad4d529d74c755225770588504731d0:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

2356d59821bb6d62813c41a375951f77:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

ac60b839f81746454d2bb743973b70c1:c83a3557d2d1:b072bf54a97b:PTCL_L2 290:11223344

83388eaca56640cb56e87a5527fe11e2:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

3389a0f054251b47a226412e078920b5:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

3389a0f054251b47a226412e078920b5:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

83388eaca56640cb56e87a5527fe11e2:c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344

Session..........: hashcat

Status...........: Cracked

Hash.Name........: WPA-PBKDF2-PMKID+EAPOL

Hash.Target......: test.22000

Time.Started.....: Sat Feb  1 20:48:40 2020 (0 secs)

Time.Estimated...: Sat Feb  1 20:48:40 2020 (0 secs)

Guess.Mask.......: 11223344 [8]

Guess.Queue......: 1/1 (100.00%)

Speed.#1.........:       36 H/s (0.71ms) @ Accel:8 Loops:128 Thr:1024 Vec:1

Recovered........: 10/10 (100.00%) Digests

Progress.........: 1/1 (100.00%)

Rejected.........: 0/1 (0.00%)

Restore.Point....: 0/1 (0.00%)

Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:9-19

Candidates.#1....: 11223344 -> 11223344

Hardware.Mon.#1..: Temp: 57c Fan: 38% Util: 55% Core:1860MHz Mem:5005MHz Bus:16

Started: Sat Feb  1 20:48:36 2020

Stopped: Sat Feb  1 20:48:42 2020

By option --all, hcxpcapngtool will convert all PMKIDs and all EAPOL messagepairs. That included many duplicates, but hashcat recovered the PSKs successful from them, too.

In that case you should use at least nonce-error-corrections=8 to recover all PSKs.

RE: need batch stop after pass found hccapx - msalman - 02-04-2020

is there any script for The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) linux which can automate hcxdumptool capture and hcxpcapngtool convert process

RE: need batch stop after pass found hccapx - ZerBea - 02-04-2020

No, you have to code it by yourself. It is very simple:
https://github.com/ZerBea/hcxtools/issues/121#issuecomment-581013958

RE: need batch stop after pass found hccapx - ZerBea - 02-06-2020

One last question: Which options have you used to capture the dumpfile?

I noticed that all(!) undirected proberequest frames are not present (filtered out).
This frames may contain information about PSKs. So it is definitely not a good idea to remove them from your cap file!

Code:
$ hcxpcapngtool ptcl_l2-test-01.cap

reading from ptcl_l2-test-01.cap...

summary capture file

--------------------

file name................................: ptcl_l2-test-01.cap

version (pcap/cap).......................: 2.4 (very basic format without any additional information)

timestamp minimum (GMT)..................: 22.01.2020 23:09:00

timestamp maximum (GMT)..................: 22.01.2020 23:11:52

link layer header type...................: DLT_IEEE802_11 (105)

endianess (capture system)...............: little endian

packets inside...........................: 70694

BEACON (total)...........................: 1

PROBEREQUEST (directed)..................: 17

PROBERESONSE.............................: 574

DEAUTHENTICATION (total).................: 10779

DISASSOCIATION (total)...................: 4

AUTHENTICATION (total)...................: 30

AUTHENTICATION (OPEN SYSTEM).............: 30

ASSOCIATIONREQUEST (total)...............: 7

ASSOCIATIONREQUEST (PSK).................: 7

REASSOCIATIONREQUEST (total).............: 6

REASSOCIATIONREQUEST (PSK)...............: 6

WPA encrypted............................: 17929

EAPOL messages (total)...................: 275

EAPOL RSN messages.......................: 275

ESSID (total unique).....................: 1

EAPOLTIME gap (measured maximum usec)....: 518630

REPLAYCOUNT gap for NC (measured maximum): 6

EAPOL M1 messages........................: 264

EAPOL M2 messages........................: 4

EAPOL M3 messages........................: 5

EAPOL M4 messages........................: 2

EAPOL pairs (total)......................: 26

EAPOL pairs (best).......................: 1

EAPOL M12E2..............................: 1

PMKID (total)............................: 270

PMKID (best).............................: 3

Warning: missing frames!

This dump file contains no undirected proberequest frames.

An undirected proberequest may contain information about the PSK.

That makes it hard to recover the PSK.

BTW:
Again, thanks for the cap file. It reminded me to add several warnings (hcxpcapngtool), to inform about missing frames, zeroed timestamps, broken timestamps, bit errors (PLCP errors).