+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: NTLM wordlist+rules Low Utilization Still (/thread-11275.html)
NTLM wordlist+rules Low Utilization Still - dhekopolis - 02-02-2023
With the below specs, command, drivers, etc. on about 8500 NTLM hashes I get an estimated 14 days to complete. That's using the Popular Royce rule. I've been able to get it down to 3 days with the OneRuleToRuleThemAll. While this is ok, with either rule I still get the same speed and seemingly low utilization.
I'm using wordlist+rule which is the recommend "fix", but if I check the status repeatedly, sometimes I will see one or the other gpu spike up briefly, but most of the time it's low %. It will show 2-3, 14, and the occasional 45. I've seen it a few times go up to 100%, but never stays in one place for longer than an instant and most of the time is less than 5%.
I'm wondering if there is something else I should be doing or trying. I've double and tripled checked the driver on a clean XUbuntu 22.04.1 LTS install. clinfo/rocminfo checks out as does hashcat -I.
Maybe the CPU is just too slow to feed the GPU's??
Thanks for your time!
COMMAND - hashcat v6.2.5
Code:
hashcat -m 1000 -w 3 -O -D 2,3 -r /pantagrule/rules/private.hashorg.royce/pantagrule.popular.royce.rule -o /home/to_crack.out /home/to_crack.ntds /home/crackstation.txtCRACKING RIG - i3-7100 w/ 2 AMD RX 480 gpus - drivers installed per the AMD instructions site
Code:
CPU: dual core Intel Core i3-7100 (-MT MCP-) speed/min/max: 800/800/3900 MHz
Kernel: 5.15.0-58-generic x86_64 Up: 7d 38m Mem: 7459.5/15872.6 MiB (47.0%)
Storage: 238.47 GiB (11.7% used) Procs: 250 Shell: Bash inxi: 3.3.13
hashcat (v6.2.5) starting in backend information mode
OpenCL Info:
============
OpenCL Platform ID #1
Vendor..: The pocl project
Name....: Portable Computing Language
Version.: OpenCL 2.0 pocl 1.8 Linux, None+Asserts, RELOC, LLVM 11.1.0, SLEEF, DISTRO, POCL_DEBUG
Backend Device ID #1
Type...........: CPU
Vendor.ID......: 128
Vendor.........: GenuineIntel
Name...........: pthread-Intel(R) Core(TM) i3-7100 CPU @ 3.90GHz
Version........: OpenCL 1.2 pocl HSTR: pthread-x86_64-pc-linux-gnu-skylake
Processor(s)...: 4
Clock..........: 3900
Memory.Total...: 13824 MB (limited to 2048 MB allocatable in one block)
Memory.Free....: 6880 MB
OpenCL.Version.: OpenCL C 1.2 pocl
Driver.Version.: 1.8
OpenCL Platform ID #2
Vendor..: Advanced Micro Devices, Inc.
Name....: AMD Accelerated Parallel Processing
Version.: OpenCL 2.1 AMD-APP (3380.4)
Backend Device ID #2
Type...........: GPU
Vendor.ID......: 1
Vendor.........: Advanced Micro Devices, Inc.
Name...........: AMD Radeon (TM) RX 480 Graphics
Version........: OpenCL 2.0 AMD-APP (3380.4)
Processor(s)...: 36
Clock..........: 1291
Memory.Total...: 4096 MB (limited to 3264 MB allocatable in one block)
Memory.Free....: 3968 MB
OpenCL.Version.: OpenCL C 2.0
Driver.Version.: 3380.4 (PAL,HSAIL)
PCI.Addr.BDF...: 07:00.0
Backend Device ID #3
Type...........: GPU
Vendor.ID......: 1
Vendor.........: Advanced Micro Devices, Inc.
Name...........: AMD Radeon (TM) RX 480 Graphics
Version........: OpenCL 2.0 AMD-APP (3380.4)
Processor(s)...: 36
Clock..........: 1291
Memory.Total...: 4096 MB (limited to 3264 MB allocatable in one block)
Memory.Free....: 3968 MB
OpenCL.Version.: OpenCL C 2.0
Driver.Version.: 3380.4 (PAL,HSAIL)
PCI.Addr.BDF...: 01:00.0SPEED
Code:
Speed.#2.........: 155.8 MH/s (86.14ms) @ Accel:32 Loops:64 Thr:256 Vec:1
Speed.#3.........: 155.4 MH/s (189.94ms) @ Accel:32 Loops:64 Thr:256 Vec:1RE: NTLM wordlist+rules Low Utilization Still - marc1n - 02-02-2023
Use the latest version of hashcat v6.2.6 and yes it may be a CPU bottleneck. Recommended processor is i5 and better.
RE: NTLM wordlist+rules Low Utilization Still - Snoopy - 02-03-2023
what tells
hashcat -D2 -b -m1000
what speed to expect?
RE: NTLM wordlist+rules Low Utilization Still - dhekopolis - 02-03-2023
(02-03-2023, 06:22 PM)Snoopy Wrote: what tells
hashcat -D2 -b -m1000
what speed to expect?
Code:
hashcat (v6.2.5) starting in benchmark mode
Benchmarking uses hand-optimized kernel code by default.
You can use it in your cracking session by setting the -O option.
Note: Using optimized kernel code limits the maximum supported password length.
To disable the optimized kernel code in benchmark mode, use the -w option.
OpenCL API (OpenCL 2.0 pocl 1.8 Linux, None+Asserts, RELOC, LLVM 11.1.0, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
=====================================================================================================================================
* Device #1: pthread-Intel(R) Core(TM) i3-7100 CPU @ 3.90GHz, skipped
OpenCL API (OpenCL 2.1 AMD-APP (3380.4)) - Platform #2 [Advanced Micro Devices, Inc.]
=====================================================================================
* Device #2: AMD Radeon (TM) RX 480 Graphics, 3968/4096 MB (3264 MB allocatable), 36MCU
* Device #3: AMD Radeon (TM) RX 480 Graphics, 3968/4096 MB (3264 MB allocatable), 36MCU
Benchmark relevant options:
===========================
* --opencl-device-types=2
* --optimized-kernel-enable
-----------------------
* Hash-Mode 1000 (NTLM)
-----------------------
Speed.#2.........: 20041.1 MH/s (59.17ms) @ Accel:256 Loops:1024 Thr:128 Vec:1
Speed.#3.........: 20013.0 MH/s (59.56ms) @ Accel:256 Loops:1024 Thr:128 Vec:1
Speed.#*.........: 40054.1 MH/s
Started: Fri Feb 3 10:44:44 2023
Stopped: Fri Feb 3 10:44:54 2023RE: NTLM wordlist+rules Low Utilization Still - dhekopolis - 02-04-2023
(02-02-2023, 11:50 PM)marc1n Wrote: Use the latest version of hashcat v6.2.6 and yes it may be a CPU bottleneck. Recommended processor is i5 and better.
I've tried .6 and no difference. I ran HTOP to see what the CPU was doing, and it never got above 10%... this leads me to believe the CPU isn't a bottleneck now...??