hashcat Forum
Problem with LM aad3b435b51404ee - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Problem with LM aad3b435b51404ee (/thread-5636.html)



Problem with LM aad3b435b51404ee - Didier Stevens - 07-12-2016

I'm experiencing a problem with LM hash aad3b435b51404ee and hashcat 3.00 on Windows 8.1.

I reduced the original problem I had to this:

file lm: aad3b435b51404ee
Command: hashcat64.exe -a 3 -m 3000 --potfile-disable lm

Output:

Code:
hashcat (v3.00-1-g67a8d97) starting...

OpenCL Platform #1: Intel(R) Corporation
========================================
- Device #1: Intel(R) HD Graphics 5000, 356/1425 MB allocatable, 40MCU
- Device #2: Intel(R) Core(TM) i7-4650U CPU @ 1.70GHz, skipped

Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Applicable Optimizers:
* Zero-Byte
* Precompute-Final-Permutation
* Not-Iterated
* Single-Hash
* Single-Salt
* Brute-Force
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled

ATTENTION!
  The wordlist or mask you are using is too small.
  Therefore, hashcat is unable to utilize the full parallelization power of your device(s).
  The cracking speed will drop.
  Workaround: https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_to_create_more_work_for_

INFO: approaching final keyspace, workload adjusted

aad3b435b51404ee:X

Session.Name...: hashcat
Status.........: Cracked
Input.Mode.....: Mask (?1) [1]
Hash.Target....: aad3b435b51404ee
Hash.Type......: LM
Time.Started...: 0 secs
Speed.Dev.#1...:        0 H/s (0.15ms)
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 36/36 (100.00%)
Rejected.......: 0/36 (0.00%)

Started: Tue Jul 12 00:32:08 2016
Stopped: Tue Jul 12 00:32:09 2016

Remark this line in the output: aad3b435b51404ee:X
aad3b435b51404ee is the LM hash of the empty string, so I did not expect to see character X.

And when I run this again, I get a different character.

When I use a POT file, it also contains a character for this hash.


I have the sample problem on my laptop and desktop (both Windows 8.1), and with hastcat32.exe and hashcat64.exe.

Any insights appreciated.


RE: Problem with LM aad3b435b51404ee - atom - 07-12-2016

Clearly a bug. Please open a GitHub Isuee


RE: Problem with LM aad3b435b51404ee - Didier Stevens - 07-15-2016

Issue reported and fixed: https://github.com/hashcat/hashcat/issues/434

Thanks.