+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: Need advice on TrueCrypt password recovery (/thread-3420.html)
Need advice on TrueCrypt password recovery - TruecryptAddict - 05-25-2014
Hi,
I'm absolutely new to this business as I've never seen any need to crack passwords. Unfortenately, I forgot the new password of my TrueCrypt container after a password change, so here I am looking for some help / advice.
First about the basics: I have an AES-encrypted TrueCrypt volume at hand. I don't know which hashing algorithm I chose back then. Right now, all I know is the approximate length of my new, lost password (should be around 18 characters) and I can narrow down the possible special characters. A dictionary will not help as I combined fantasy words and I'm absolutely unsure about my new password. My computer has a i7-4770 CPU and an AMD HD5770 graphics card, which is why I downloaded oclHashcat 1.20. My Catalyst version is 14.04. To make things worse I experience stability problems which might be GPU / heat related. For example, running example0 will stop with a GPU temperature warning.
My plan is to setup oclHashcat and run a few examples to find out my options. At the moment I think I will have to settle for a Brute Force attack (ugly, ugly...), but I think I can reduce the characters. I will think harder about my possible password so I can optimize my attack and use permutation mode or hybrid mode.
Enough blabla, here are some specific questions:
1) Is it possible at all to define custom charsets? EDIT: found out by myself
2) Is it reasonable at all to try to recover this password or will my computer have to run for the next 3 million years? ;-)
3) Does oclHashcat support resuming after a possible machine crash?
4) How do I find out my TrueCrypt volume's hash? I will need this as input, of course.
5) Do I need to specify my volume's hash algorithm? How do I find out, if possible?
6) I will think harder about my possible password so I can optimize my attack and use permutation mode or hybrid mode.
Thank you for any help in advance.
RE: Need advice on TrueCrypt password recovery - Rolf - 05-25-2014
(05-25-2014, 08:55 PM)TruecryptAddict Wrote: 1) Is it possible at all to define custom charsets?Yes, that's what "-1" - "-4" flags are for.
(05-25-2014, 08:55 PM)TruecryptAddict Wrote: 2) Is it reasonable at all to try to recover this password or will my computer have to run for the next 3 million years? ;-)Reasonable if you can reduce the keyspace to something attackable within current specs.
(05-25-2014, 08:55 PM)TruecryptAddict Wrote: 3) Does oclHashcat support resuming after a possible machine crash?Yes, the "--restore" flag is what you need.
Atom/Philipp can clarify how frequently it is written to disk.
(05-25-2014, 08:55 PM)TruecryptAddict Wrote: 4) How do I find out my TrueCrypt volume's hash? I will need this as input, of course.Say what?
(05-25-2014, 08:55 PM)TruecryptAddict Wrote: 5) Do I need to specify my volume's hash algorithm? How do I find out, if possible?Of course.
There is no way to find the hashing algorithm out, except remembering it.
(05-25-2014, 08:55 PM)TruecryptAddict Wrote: 6) I will think harder about my possible password so I can optimize my attack and use permutation mode or hybrid mode.Good and probably only choice you have.
RE: Need advice on TrueCrypt password recovery - TruecryptAddict - 05-25-2014
Hi Rolf,
thank you for your answers. I will rephrase my question 4 from above. I guess my wording is too complicated. The examples delivered with oclHashcat have a .hash file each containing the passwords to be recovered. I will need to specify my volume's hash, is that correct? oclHashcat needs to know which hash it should crack.
RE: Need advice on TrueCrypt password recovery - Rolf - 05-25-2014
Nope.
Just feed it your tc volume with any extension, it automatically grabs the required info from the corresponding offsets.
RE: Need advice on TrueCrypt password recovery - TruecryptAddict - 05-25-2014
Okay, I just created a Truecrypt volume for test purposes so I have a chance to setup oclHashcat correctly. The password is fixed to nine letters. My command line looks like this:
oclHashcat64.exe -t 32 -a 3 -m 6211 -1 charsets/maik.hcchr test ?1?1?1?1?1?1?1?1?1
Does this look correct? Estimated time is > 10 years for this test. This is a letdown but I expected this. As a result brute force is definately not an option, but at least I have a setup which makes use of my own charset.
RE: Need advice on TrueCrypt password recovery - undeath - 05-25-2014
command line looks fine, but don't mess with -t unless you know what you are doing.