(04-02-2018, 10:13 AM)philsmd Wrote: I must admit that I didn't understand at all what you mean by this x+1 and x+2, y etc... but I would recommend that you just read the documentation on how to use hashcat mask files (.hcmask):
1. https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#what_is_a_hashcat_mask_file
2. https://hashcat.net/wiki/doku.php?id=mask_attack#hashcat_mask_files

The idea is very easy. You always need a mask within your lines of a hashcat mask file (.hcmask).
If you need to use custom charsets (that are not just built-in charset but combined or custom chars) you also need to define the custom charsets. The format is as mentioned above, therefore either:
mask
or
CS1,maskUsingCS1
or
CS1,CS2,maskUsingCS1andCS2
or
CS1,CS2,CS3,maskUsingCS1andCS2andCS3
or
CS1,CS2,CS3,CS4,maskUsingCS1andCS2andCS3andCS4

The range of custom charsets is from 0 to 4 custom charsets. Again, if you want to use built-in charsets or a single byte-long constant substring (char) you do not need to use any custom charset at all for that position.

I think what you are currently not aware of is that the definition of a custom charset is not the same as the concept of a mask, which is using built-in charsets, custom charset and constant chars. These are 2 very distinct concepts. The former defines a set of characters (like a variable) and the latter (the mask) defines the length and per-position use of the chars.
A hashcat mask file always needs to have a mask within each line, while definition of character sets are only needed/meaningful if you need them within your mask (within that specific line).

I think the FAQ/wiki sections should be easy enough to get you started with defining your own hashcat mask files. BTW: there are even some tools like policygen.py from PACK that could help in automatically generating hashcat mask files (altrough I'm not totally sure if it is applicable to your specific scenario, because I honestly didn't really understand your "rules", especially the x+1, x+2, y etc rules)

---

btw: it could also make sense to just post some example passwords that follow your "rules" and maybe somebody could help you to come up with a hashcat mask file which catches all of those passwords. Of course the password list should demonstrate most/all of the "rules" such that the hcmask file can be defined correctly and matches all the policies/rules