+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Office collision: 7 or more characters? (/thread-6154.html)
Office collision: 7 or more characters? - Mem5 - 12-26-2016
Hello !
I am trying to collide an Office hash : $oldoffice$0*aa*bb*cc. I use :
Quote:9710 | MS Office <= 2003 $0|$1, MD5 + RC4, collider #1
hashcat64.exe -w 3 -m 9710 office.hash -a 3 ?b?b?b?b?b -o tmp_office.txt
This command give me this RC4 key :
Quote:$oldoffice$0*aa*bb*cc:2c2c2c2c2c
Then, I use 9720 MS Office <= 2003 MD5 + RC4, collision-mode #2
Quote:hashcat64.exe -w 3 -m 9720 tmp_office.txt -a 3 ?a?a?a?a?a?a?a
After 7 hours, exhausted, but no password found.
Does it mean my charset (seven times ?a) is not big enough ?
I though this mode (9720) would find a collision with only 7 characters.
8 times ?a is huge and long.
Thanks for your help.
RE: Office collision: 7 or more characters? - atom - 12-26-2016
What's the problem here?
RE: Office collision: 7 or more characters? - Mem5 - 12-28-2016
The command:
Quote:hashcat64.exe -w 3 -m 9720 tmp_office.txt -a 3 ?a?a?a?a?a?a?a
does not give any collisions. For the first time ever.
Am I doing something wrong ?
RE: Office collision: 7 or more characters? - atom - 12-29-2016
Well, MD5 is 128 bit while RC4 (in this case) is only 40 bit. The mode #2 is not made to find collisions, it's more to find the correct password used. Having the correct password gives you the chance to test it with other archives.