Missing partial password chunk in LM cracking

Missing partial password chunk in LM cracking - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Ancient Versions (https://hashcat.net/forum/forum-46.html)
+--- Forum: Very old oclHashcat-lite Support (https://hashcat.net/forum/forum-22.html)
+--- Thread: Missing partial password chunk in LM cracking (/thread-903.html)

Pages: 1 2 3

Missing partial password chunk in LM cracking - forumhero - 02-07-2012

if the password is more than 7 character, how do i find the other half? i created an LM hash of the word "password" but missing the "d" at the end once found, even though i specified mask of 8 char, it limits to 7 char.

./oclHashcat-lite64.bin -m 3000 e52cac67419a9a224a3b108f3fa6cb6d -1 ?l ?1?1?1?1?1?1?1?1

e52cac67419a9a224a3b108f3fa6cb6d Tongue

ASSWOR

Status.......: Cracked
Hash.Target..: e52cac67419a9a224a3b108f3fa6cb6d
Hash.Type....: LM
Time.Running.: 6 secs
Time.Left....: 0 secs
Plain.Mask...: ?1?1?1?1?1?1?1
Plain.Text...: ***ECSC
Plain.Length.: 7
Progress.....: 5839630976/8031810176 (72.71%)

RE: LM hash support for OCLHC - chort - 02-07-2012

The same mask is applied to both sides (and since LM can hash at most 14 characters, that makes the longest mask 7).

1=8
2=9
...
6=13
7=14

RE: Missing partial password chunk in LM cracking - atom - 02-07-2012

what chort says is correct, however oclHashcat-lite uses --increment mode by default. Even if his mask is set to 8x?l, it will start with 1x?l and iterate through 7x?l and ignores the 8th ?l. This is why oclHashcat-lite reports "cracked". It can do this only in case if both sides have been found. It is just not displaying the 2nd half. Looks like an unknown bug. Have to investigate. Thanks for reporting.

RE: Missing partial password chunk in LM cracking - mastercracker - 02-07-2012

(02-07-2012, 10:03 AM)atom Wrote: what chort says is correct, however oclHashcat-lite uses --increment mode by default. Even if his mask is set to 8x?l, it will start with 1x?l and iterate through 7x?l and ignores the 8th ?l. This is why oclHashcat-lite reports "cracked". It can do this only in case if both sides have been found. It is just not displaying the 2nd half. Looks like an unknown bug. Have to investigate. Thanks for reporting.

I had reported it in the Announcement section. It cracks the hash but the second part is not shown in the output. I suspect that it's because the second part is cracked first and eventually it's value gets replaced or overwritten when the first part is crack afterward.

RE: Missing partial password chunk in LM cracking - atom - 02-08-2012

i can not reproduce this:

Quote:root@sf:~/oclHashcat-lite-0.10# ./oclHashcat-lite64.bin -m 3000 e52cac67419a9a224a3b108f3fa6cb6d -1 ?l ?1?1?1?1?1?1?1?1
oclHashcat-lite v0.10 by atom starting...

** Valid keyfile for beta usage: atom (expires 03.02.2013)

GPU-Loops: 16
GPU-Accel: 160
Password lengths range: 1 - 55
Platform: AMD compatible platform found
Watchdog: Temperature limit set to 90c
Device #1: Tahiti, 3072MB, 0Mhz, 32MCU

e52cac67419a9a224a3b108f3fa6cb6dASSWORD

Status.......: Cracked
Hash.Target..: e52cac67419a9a224a3b108f3fa6cb6d
Hash.Type....: LM
Time.Running.: 4 secs
Time.Left....: 3 secs
Plain.Mask...: ?1?1?1?1?1?1?1
Plain.Text...: ***AAAA
Plain.Length.: 7
Progress.....: 3995074560/8031810176 (49.74%)
Speed.GPU.#1.: 1078.9M/s
HWMon.GPU.#1.: 61% GPU, 49c Temp

Started: Wed Feb 8 10:33:36 2012
Stopped: Wed Feb 8 10:33:42 2012

please verify on your gpu again

RE: Missing partial password chunk in LM cracking - mastercracker - 02-08-2012

I have double-checked on my GPU. It seems that attacks with uppercase and numbers work fine. It gave a problem with a password containing a ! at the end. Here was my command line:

Code:
Cudahashcat-lite64.exe -d 1,3,4 --session=1 -m 3000 --pw-min=1 --pw-max=7 -o found1.txt EAxAEEx23x905x72x15xA0xCxD87x4xC -1 ?d?u -2 ?s?d?u ?1?1?1?1?1?1?2

I can provide the exact hash if you need it. The password was 14 characters long. By the way, in your example, it was not very efficient to use ?l for this algo. However it proves that OclHashcat-lite treats it efficiently as an uppercase. If a user puts ?l?u in the command line, will it double the keyspace searched or it will just use the equivalent of ?u by default?

RE: Missing partial password chunk in LM cracking - atom - 02-08-2012

i need something to reproduce, otherwise i cant fix it (if there is anything to fix).

yes, ?u will be translated into ?l and if both exists, it will get "merged", so the charset stays at 26 even if you do -1 ?l?u

RE: Missing partial password chunk in LM cracking - mastercracker - 02-08-2012

(02-08-2012, 04:42 PM)atom Wrote: i need something to reproduce, otherwise i cant fix it (if there is anything to fix).

yes, ?u will be translated into ?l and if both exists, it will get "merged", so the charset stays at 26 even if you do -1 ?l?u

Ok. Hash: EAAAEE9238905B728156A08CED87347C
Password: :MSAPIRJ141116!

What i get in the output file is:

eaaaee9238905b728156a08ced87347c:MSAPIRJ

RE: Missing partial password chunk in LM cracking - atom - 02-09-2012

dont like the way how lm is done in lite, plus will be different. suggestions are welcome

RE: Missing partial password chunk in LM cracking - mastercracker - 02-09-2012

(02-09-2012, 10:45 AM)atom Wrote: dont like the way how lm is done in lite, plus will be different. suggestions are welcome

This is just a brainstorming session to start some ideas. Again, I think that everything would be much simpler for you to code if you would only have to deal with the halves of the LM hash. However, if you want to please all the users, you could always make 2 modes: LM and HalfLM. I guess however that if the LM mode works it's more or less relevant to have the HalfLM as well. Bottom line of what I want to say is that if it make things easier to code, I think that the splitting and assembling of the LM hash is doable by the users but I am not sure that most people will want to sacrifice that. You can code everything considering only the halves, have a routine that parse and split the LM hash, crack them and save the cracked halves in a file like LM.pot. At the end of the attack, you can do a lookup in the LM.pot file to reassemble the full LM hash and output to the user defined file the whole hash with the found password and put <not found> in the case of a LM hash where only one of it's halves have been found like PASSWOR<not found>. Actually, keeping the LM.pot file and quick lookup at the start might prevent retrying to crack the same halves over and over. I am just not sure if the price of doing a lookup, will always be faster then cracking an HalfLM of short length. For the statistics, I would keep the number of halves and not the number of hashes to display what has been found so far (when you press the s key).

For the -lite version, as soon as 1 half is cracked, I would like the status display to autoupdate and mention the fact that at least one half have been cracked.

P.S. I don't know if you could replicate the problem I mentioned earlier but I just realized that I did not revert to previous driver like you asked me to do into another post (about MD5(Wordpress) mode rejecting all the words of the wordlist) so it could still potentially come from that as well. I will try that as soon as I get back home.