+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: weird mask attack (/thread-2994.html)
weird mask attack - inoo - 01-08-2014
Hello, I found weird thing when I executed oclHashcat-1.01 with -m 300
for example:
./oclHashcat64.exe -a 3 -m 300 --remove --status \
./mysql_hash.txt -o ../mysql_hash_result.txt \
./masks/rockyou-1-60.hcmask
----------OUTPUT------------
Session.Name...: oclHashcat
Status.........: Running
Input.Mode.....: Mask (?1) [1]
Hash.Target....: File (../hash/mysql/mysql_hash.txt)
Hash.Type......: MySQL
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...: 0 H/s
Recovered......: 0/2 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 0/62 (0.00%)
Rejected.......: 0/0 (0.00%)
HWMon.GPU.#1...: 24% Util, 5c Temp, N/A Fan
Session.Name...: oclHashcat
Status.........: Running
Input.Mode.....: Mask (?1?2) [2]
Hash.Target....: File (../hash/mysql/mysql_hash.txt)
Hash.Type......: MySQL
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...: 0 H/s
Recovered......: 0/2 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 0/2232 (0.00%)
Rejected.......: 0/0 (0.00%)
HWMon.GPU.#1...: 30% Util, 5c Temp, N/A Fan
...
...
in rockyou-1-60.hcmask file, there is no pre-defined CS [1],[2],[3],[4]
but oclHashcat was running normally with [1][2][3][4] type masks
Is it normal thing?
I don't know whether hashcat bug or not?
RE: weird mask attack - philsmd - 01-08-2014
There is something strange in your output, for instance it says it uses the hashes located at ../hash/mysql/mysql_hash.txt but your command line says it should use the file mysql_hash.txt in the current directory
The problem is, since you changed the output and/or the command we can't be sure what the problem is.
why don't you try a very basic command like:
Code:
./oclHashcat64.exe -m 0 example0.hash -a 3 masks\rockyou-1-60.hcmaskFurthermore, on a test windows machine all paths expand w/ "\" (but dunno if this is the problem), also note: if you run just ./oclHashcat64.exe -m 0 example0.hash -a 3 the output - sequence of masks - you just posted is to be expected (since this is the default behaviour, i.e. increment enabled + default mask + charsets)
And I am also not sure if those lines breaks + "\" influence the behaviour (it could be if you forget to add spaces etc before the "\" newline break)
RE: weird mask attack - inoo - 01-09-2014
Thank you for answer.
I am sorry about missing oclHashcat64.exe in win7/cygwin/bash environment.
so, cmd line is the same as Linux/bash env , though my env is win7,
for example : use \(linux/unix) instead ^(dos), /(linux path seperater) instead \(dos path sep)
the cmd line is original except hash file and output file paths as you comment out
I try your recommended cmd, Linux/oclHashcat64.bin -m 3 commnd is normal as I expected
Many thanks;
RE: weird mask attack - inoo - 01-09-2014
I upload the log file..
RE: weird mask attack - philsmd - 01-09-2014
These lines:
Code:
$HASHCAT -a 3 -m 300 --remove --status --gpu-temp-retain=95 \
../hash/mysql/mysql_hash.txt -o ../hash/mysql/mysql_hash_result.txt
../oclHashcat-1.01/masks/rockyou-1-64.hcmaskmake oclHashcat run without any (user-specified) mask (nor hcmask, => default mask + increment) .... since there is no "\" after the output file "../hash/mysql/mysql_hash_result.txt" oclHashcat will start without getting the information that you also specified a hcmask...
This is because you didn't add the (second) "\" (== skip newline) and the next line:
Code:
../oclHashcat-1.01/masks/rockyou-1-64.hcmaskwill be interpreted as a new command