+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: Can hybrid attack work with rules? (/thread-4003.html)
Can hybrid attack work with rules? - SopalajoArrierez - 01-23-2015
OCLHashCat v1.32 yields no error for this command-line (hybrid attack):
Code:
oclhashcat64 -m 1000 Hashes.txt -a 6 Dictio.txt ?d -j dSo, can I assume that "-j" option (rule for left dictionary) works with this attack?
Thanks you.
RE: Can hybrid attack work with rules? - atom - 01-23-2015
Single rules (-j) are supposed to work in this case, just -r is not.
RE: Can hybrid attack work with rules? - SopalajoArrierez - 01-24-2015
Well... then, I think I have found a bug in OCLHashCat.
Case command-line:
Code:
# Creation of the password test file with key example "rafa3rafa3:
temp=$(iconv -f ASCII -t UTF-16LE <(printf "rafa3rafa3") | openssl dgst -md4)
temp=$(echo $temp | awk 'NF>1{print $NF}')
temp="Administrador:500:aad3b435b51404eeaad3b435b51404ee:"$temp":::"
echo $temp > TestPassword.txt
oclhashcat64 -m 1000 TestPassword.txt -a 6 "c:\Dictionaries\cain.txt" ?d -j d
oclHashcat v1.32 starting...
Device #1: Bonaire, 1024MB, 1050Mhz, 12MCU
Device #2: Tahiti, 3072MB, 1000Mhz, 32MCU
Device #3: Tahiti, 3072MB, 900Mhz, 28MCU
Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes
Applicable Optimizers:
* Zero-Byte
* Precompute-Init
* Precompute-Merkle-Demgard
* Meet-In-The-Middle
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Scalar-Mode
* Raw-Hash
Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger set to 80c
Device #1: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/m01000_a1.Bonaire
_1573.4_1573.4 (VM).kernel (190372 bytes)
Device #1: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/markov_le_v2.Bona
ire_1573.4_1573.4 (VM).kernel (39912 bytes)
Device #2: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/m01000_a1.Tahiti_
1573.4_1573.4 (VM).kernel (190384 bytes)
Device #2: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/markov_le_v2.Tahi
ti_1573.4_1573.4 (VM).kernel (39952 bytes)
Device #3: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/m01000_a1.Tahiti_
1573.4_1573.4 (VM).kernel (190384 bytes)
Device #3: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/markov_le_v2.Tahi
ti_1573.4_1573.4 (VM).kernel (39952 bytes)
Generating dictionary stats for j:\Repositorio de Diccionarios para Ataques\Dicc
ionarios Base\Precompilados\cain.txt: 3149586 bytes (100.00%), 306706 words, 306
Generated dictionary stats for j:\Repositorio de Diccionarios para Ataques\Dicci
onarios Base\Precompilados\cain.txt: 3149586 bytes, 306706 words, 3067060 keyspa
ce
INFO: approaching final keyspace, workload adjusted
Session.Name...: oclHashcat
Status.........: Exhausted
Input.Left.....: File (j:\Repositorio de Diccionarios para Ataques\Diccionarios
Base\Precompilados\cain.txt)
Input.Right....: Mask (?d) [1]
Hash.Target....: 58a4b878e3ba2e06093acfae1d872391
Hash.Type......: NTLM
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...: 225.2 MH/s
Speed.GPU.#2...: 593.2 MH/s
Speed.GPU.#3...: 466.1 MH/s
Speed.GPU.#*...: 1284.5 MH/s
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 3067060/3067060 (100.00%)
Skipped........: 0/3067060 (0.00%)
Rejected.......: 35570/3067060 (1.16%)
HWMon.GPU.#1...: 0% Util, 35c Temp, 22% Fan
HWMon.GPU.#2...: 3% Util, 39c Temp, 21% Fan
HWMon.GPU.#3...: 35% Util, 38c Temp, 30% Fan
WARNING: Failed to restore default fan speed for gpu number: 2:
Started: Sat Jan 24 04:53:54 2015
Stopped: Sat Jan 24 04:53:56 2015I think the rule is being ignored.
Same results for "-k" intead of "-j".
Should I open a bug ticket?
Note: Cain dictionary downloaded from here:
http://downloads.skullsecurity.org/passwords/cain.txt.bz2
RE: Can hybrid attack work with rules? - epixoip - 01-24-2015
I don't think that attack does what you think it does. Your plaintext input is "rafa3rafa3". If cain.txt contains the word "rafa", then "-a 6 cain.txt ?d -j d" will generate the candidate "rafarafa3" but not "rafa3rafa3".
RE: Can hybrid attack work with rules? - SopalajoArrierez - 01-24-2015
(01-24-2015, 07:36 AM)epixoip Wrote: If cain.txt contains the word "rafa", then "-a 6 cain.txt ?d -j d" will generate the candidate "rafarafa3" but not "rafa3rafa3".I understand: rules are applied before, and idctionary combination is applied later. Thanks you.
Then the only way to generate "rafa3rafa3" would be the previous generation of a dictionary "cain.txt" combined with "?d" (1 decimal digit), so it will contain the word "rafa3" and do:
Code:
oclhashcat64 -m 1000 TestPassword.txt cain-mask-1xd.txt -j dRE: Can hybrid attack work with rules? - philsmd - 01-24-2015
to avoid to generate a large dict also something like this would work in your particular case:
file: my_append_num_and_duplicate.rule
Code:
$0 d
$1 d
$2 d
$3 d
$4 d
$5 d
$6 d
$7 d
$8 d
$9 dCode:
oclhashcat64 -m 1000 -r my_append_num_and_duplicate.rule TestPassword.txt cain.txtRE: Can hybrid attack work with rules? - SopalajoArrierez - 01-24-2015
(01-24-2015, 08:43 AM)philsmd Wrote: to avoid to generate a large dict also something like this would work in your particular case:A good idea, indeed.
Code:oclhashcat64 -m 1000 -r my_append_num_and_duplicate.rule TestPassword.txt cain.txt
Would it be the same as this other one?
Code:
oclhashcat64 -m 1000 -r my_append_num.rule TestPassword.txt cain.txt -j dConsidering the file is now:
Code:
$0
$1
$2
$3
$4
$5
$6
$7
$8
$9RE: Can hybrid attack work with rules? - SopalajoArrierez - 01-24-2015
Mmm.. I think I could answer myself. Acording to my tests, it seems that the order between -r, -j and -k would be:
-j goes first.
-r goes second.
-k doesn't go: it is ignored.
Am I right?
RE: Can hybrid attack work with rules? - philsmd - 01-24-2015
-k is applied only on the second dictionary. So it makes sense for instance with "-a 1 dict1.txt dict2.txt".
So technically it isn't ignored, it just not applied since there is no second dictionary (or better said, the right-hand side) in your particular case.
Btw. I am not quite sure why you insist to use -j d . If you want to "split" the rules, there is also another interesting feature called multi-rules: see https://hashcat.net/wiki/doku.php?id=rule_based_attack#multi-rules .
Basically, you can do -r append_num.rule -r duplicate.rule
RE: Can hybrid attack work with rules? - SopalajoArrierez - 01-24-2015
(01-24-2015, 09:27 AM)philsmd Wrote: If you want to "split" the rules, there is also another interesting feature called multi-rules: see https://hashcat.net/wiki/doku.php?id=rule_based_attack#multi-rules .Fine! That is the one I was searching for.
Basically, you can do -r append_num.rule -r duplicate.rule
When reading the docs, I thought multirules where sequential (attack the hash by using append_num.rule, then attack the hash by using duplicate.rul, not combined).
It makes more sense now.
Thanks you all for explaining.