+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old hashcat Support (https://hashcat.net/forum/forum-20.html)
+--- Thread: Help with Russian again (/thread-2016.html)
Pages:
1
2
Help with Russian again - mastercracker - 01-30-2013
This is a follow up on the following thread which was closed:
http://hashcat.net/forum/thread-1204.html
So here's the hash:pass in question (from the mentioned post, not real user data):
507620db658a3d55c367cc8273e2ee24:ьфдщн
I was able to crack the hash using the password in a dictionary (UTF8 format) but when I try to crack it via bruteforce, it does not work. Here's the command line I use
Hashcat-cli64 -a 3 -m 0 hash.txt ?R?R?R?R?R
Is it me or it's not working for other people as well. Waiting for this to create a trac.
RE: Help with Russian again - epixoip - 01-30-2013
this is because ?R is ISO-8859-5 and your characters are UTF-8. different byte sequences.
RE: Help with Russian again - mastercracker - 01-30-2013
(01-30-2013, 04:20 PM)epixoip Wrote: this is because ?R is ISO-8859-5 and your characters are UTF-8. different byte sequences.But the ?R charset was meant to be able to crack Russian password, no? Are you saying that it's possible to write the same characters using ISO-8859-5, generate an MD5 hash and that this MD5 hash would be different from 507620db658a3d55c367cc8273e2ee24?
RE: Help with Russian again - undeath - 01-30-2013
> echo -n ьфдщн | md5sum
507620db658a3d55c367cc8273e2ee24 -
> echo -n ьфдщн | iconv -f UTF-8 -t ISO-8859-5 | md5sum
6cda8fbf4ea51d58118e440e1cc478e4
RE: Help with Russian again - mastercracker - 01-30-2013
Thanks epixoip and undeath. Now I am getting it. These 3 MD5 hashes represent the same Russian password but with different encodings:
714d5bc5daad4412e118d1bfd0c7477b Cyrillic windows 1251
507620db658a3d55c367cc8273e2ee24 UTF8
6cda8fbf4ea51d58118e440e1cc478e4 - ISO-8859-5
In order to crack these passwords you need to know the exact system's encoding. Now, I have to check something. If I am not mistaken, we can load charset from files for some Hashcat products. Which one(s) is the question.
RE: Help with Russian again - Rolf - 01-30-2013
I've never seen passwords in that ISO-8859-5 encoding, Russian versions of Windows use 1251.
RE: Help with Russian again - epixoip - 01-31-2013
good feedback.
i can't think of a solution for mask attacks off hand, but if you have russian wordlists in utf8 you can prepare them for use with hashcat with ''iconv -t WINDOWS-1251 wordlist >wordlist.1251'', or pipe ''iconv -t WINDOWS-1251 wordlist'' into hashcat via stdin.
RE: Help with Russian again - epixoip - 01-31-2013
Code:
epixoip@ike:~$ echo -n ьфдщн | iconv -f UTF-8 -t ISO-8859-5 | hexdump
00000000 ec e4 d4 e9 dd
00000005
epixoip@ike:~$ echo -n ьфдщн | iconv -f UTF-8 -t windows-1251 | hexdump
00000000 fc f4 e4 f9 ed
00000005actually it looks like with windows-1251, all of the characters are essentially iso-8859 + 0x10. so you can build a mask attack using hex charset.
RE: Help with Russian again - atom - 01-31-2013
Btw, all hashcat version support charset files. But they must been encoded with a 8 bit based encoding. That is ISO-8859-5 and windows-1251. Just enter all the chars you like in a charset and save it with the corresponding encoding, then do -1 mycharset.chr
RE: Help with Russian again - mastercracker - 01-31-2013
Interesting. Putting all the characters in a charset file that was Windows-1251 encoded and using the -1 russian.charset, cracked both the hash generated by windows-1251 encoding and the ISO-8859-5 one. Now what should be the equivalent encoding for German and French.