hashcat Forum
trouble with excel password recovery - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: trouble with excel password recovery (/thread-9812.html)

trouble with excel password recovery - stephent137 - 01-25-2021

I have the office hash for the file it's   $oldoffice$4*XXXX*XXXX*XXXX so going by the guides i found here, I've tried

on windows, from command prompt

hashcat.exe -m 9800 hash.txt -a 3 -w 3 ?b?b?b?b?b

however the final result i get back from it is:


Session..........: hashcat
Status...........: Exhausted
Hash.Name........: MS Office <= 2003 $3/$4, SHA1 + RC4
Hash.Target......: $oldoffice$4*XXXX*XX...XX
Time.Started.....: Sun Jan 24 21:06:39 2021 (43 mins, 32 secs)
Time.Estimated...: Sun Jan 24 21:50:11 2021 (0 secs)
Guess.Mask.......: ?b?b?b?b?b [5]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  420.8 MH/s (47.47ms) @ Accel:256 Loops:64 Thr:64 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 1099511627776/1099511627776 (100.00%)
Rejected.........: 0/1099511627776 (0.00%)
Restore.Point....: 4294967296/4294967296 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:192-256 Iteration:0-64
Candidates.#1....: $HEX[826e00ffff] -> $HEX[ffffffffff]
Hardware.Mon.#1..: N/A

Started: Sun Jan 24 21:06:36 2021
Stopped: Sun Jan 24 21:50:11 2021
LLVM ERROR: IO failure on output stream: bad file descriptor



Two questions
  1. Am I following the guide correctly. It's an office 4 file so that suggested i use -m 9800   (or should i use 9810).  I was following this : https://hashcat.net/forum/thread-3665.html
  2. I kept getting the error on finishing the job:   LLVM ERROR: IO failure on output stream: bad file descriptor
I first thought it was because it couldn't write a file for some reason so I removed the output parameters ... I originally tried running it as hashcat.exe -m 9810 hash.txt -a 3 -w 3 ?b?b?b?b?b -o hash.rc4

that came back with

Session..........: hashcat
Status...........: Exhausted
Hash.Name........: MS Office <= 2003 $3, SHA1 + RC4, collider #1
Hash.Target......: $oldoffice$4*XXXX*XXXX...XXX
Time.Started.....: Sun Jan 24 20:14:41 2021 (40 mins, 48 secs)
Time.Estimated...: Sun Jan 24 20:55:29 2021 (0 secs)
Guess.Mask.......: ?b?b?b?b?b [5]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  449.3 MH/s (90.57ms) @ Accel:256 Loops:128 Thr:64 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 1099511627776/1099511627776 (100.00%)
Rejected.........: 0/1099511627776 (0.00%)
Restore.Point....: 4294967296/4294967296 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:128-256 Iteration:0-128
Candidates.#1....: $HEX[cd6172ffff] -> $HEX[ffffffffff]
Hardware.Mon.#1..: N/A


Started: Sun Jan 24 20:14:34 2021
Stopped: Sun Jan 24 20:55:31 2021
LLVM ERROR: IO failure on output stream: bad file descriptor



A point in the correct direction would be helpful.
Thanks