running hashcat with psexec

[nxte]

I searched the forums for "psexec" which returned nothing. Hopefully this will not be a repeat question.

I am trying to set up a quasi distributed cracking method using psexec from the Sysinternals suite.

http://technet.microsoft.com/en-us/sysin...97553.aspx

All systems are running windows 7 (64) with nvidia gpu's. This is just a test run to see if i can even use hashcat through psexec.

I am capable of connecting to each machine with psexec and opening a command line.
"psexec -u account -p password \\ip-address cmd" will open a command line and authenticate fine.

When I navigate to the hash cat folder and run-
cudaHashcat-plus64.exe -a 3 -m 0 -o output.txt --increment-min=6 --increment-max=9 hash.txt --force

I get the error: no NVidia compatible platform found. When I run this same command locally on the machine, hashcat will start working. To be clear, I do have hashcat working perfectly fine locally.

When I try to run psexec authentication and hashcat from the same line-

psexec -u account -p password \\ip-address "C:\Users\forensics\Desktop\hashcat\cudahashcat-plus64.exe"

it will return the normal message if you attempt to run hashcat with no commands:

[options]...etc
try --help for more help

When I try to run psexec authentication and hashcat with commands:

psexec -u account -p password \\ip-address "C:\Users\forensics\Desktop\hashcat\cudaHashcat-plus64.exe" -a 3 -m 0 -o cracked.txt --increment-min=6 --increment-max=7 hash.txt --force

I get "Warning: Hash 'hash.txt': line-length exception
error: no hashes loaded

psexec -u account -p password \\ip-address "C:\Users\forensics\Desktop\hashcat\cudaHashcat-plus64.exe" -a 3 -m 0 -o cracked.txt --increment-min=6 --increment-max=7 "C:\Users\forensics\Desktop\hashcat\hash.txt" --force

returns the same line-length exception error.

psexec -u account -p password \\ip-address "C:\Users\forensics\Desktop\hashcat\cudaHashcat-plus64.exe" -a 3 -m 0 -o cracked.txt --increment-min=6 --increment-max=7 TheHashInQuestion --force

Error: No NVidia compatible platform found.

Any suggestions? Or has anyone had any luck using hashcat with psexec?

[radix]

if you are on nvidia you should be running cudaHashcat

you are also specifying -a 3, but not giving it a mask to use.

[nxte]

Radix,
Thanks for the reply. I confirmed I am actually trying "cudaHashcat-plus64.exe."

I am using the internet on my laptop but trying these runs on machines that do not have internet access. I am basically re-typing everything manually on these help forums. I think i spelled out oclhashcat the first time and copied/pasted it while creating this post. Sorry for the miscommunication, I will edit the orig post.

But yes, I am actually using "cudaHashcat-plus64.exe" in these runs. I also tested the commands again just to be sure.

I am still getting an error: "No Nvidia compatible platform found".

[radix]

hmm, I wonder then if psexec isnt able to access the video. can you try with cpu hashcat and see if it will let you run?

[nxte]

Radix,
I just attempted it with hashcat-cli64

locally: hashcat-cli64.exe -m 0 -a 3 -o cracked.txt hash.txt ?l?l?l?l?l?l?l?l
This works locally on the machine.

with PsExec:
psexec -u uname -p pw \\IP-address "C:\Users\forensics\Desktop\cpuhashcat\hashcat-cli64.exe" -m 0 -a 3 -o cracked.txt hash.txt ?l?l?l?l?l?l?l?l

returns: Ihash.txt: no such file or directory
exiting with error code: -1.

Im not sure why it appends "I" onto the hash file. I ensured the command does not actually say "Ihash.txt".

Then tried:
psexec -u uname -p pw \\IP-address "C:\Users\forensics\Desktop\cpuhashcat\hashcat-cli64.exe" -m 0 -a 3 -o cracked.txt "C:\Users\forensics\Desktop\cpuhashcat\hash.txt" ?l?l?l?l?l?l?l?l

This actually worked and cracked the hash!

I am now going back to cudaHash and enclosing the hash file with " and the directory. I believe i tried this method earlier with no results, but will attempt again.

[nxte]

"C:\Users\forensics\Desktop\hashcat\cudaHashcat-plus64.exe" -m 0 -a 3 -o cracked.txt "C:\Users\forensics\Desktop\hashcat\hash.txt" ?l?l?l?l?l?l?l?l

Error: if you want to brute-force (-a 3) a single hash of the hash type (-m 0) use oclhashcat-lite use --force to ignore this warning.

exited with error code -1.

"C:\Users\forensics\Desktop\hashcat\cudaHashcat-plus64.exe" -m 0 -a 3 -o cracked.txt "C:\Users\forensics\Desktop\hashcat\hash.txt" ?l?l?l?l?l?l?l?l --force

Error: No Nvidia compatible platform found.

"C:\Users\forensics\Desktop\hashcatlite\cudaHashcat-lite64.exe" -m 0 -a 3 -o cracked.txt "C:\Users\forensics\Desktop\hashcatlite\hash.txt" ?l?l?l?l?l?l?l?l --force

Error: Invalid argument

"C:\Users\forensics\Desktop\hashcatlite\cudaHashcat-lite64.exe" md5hash ?l?l?l?l?l?l?l?l

Error: No Nvidia platform found

[radix]

looks like for whatever reason psexec cant access the driver

[nxte]

Okay Thanks for the help radix.

Guess I will just go with RDP

[radix]

You might encounter the same with RDP. IIRC RDP uses its own video driver which block access to the nvidia libraries.

[nxte]

Yes I can verify that I experience the same error with RDP.

I still do not understand why it does not work with PsExec. I just want my machine to tell the remote machine to do a job, using the local resources. I would assume PsExec would tell hashcat to do a job, and then hashcat would be directing the local resources to do the specified work, as if I had entered the commands locally.

Aside from that, Thanks to the hashcat team for creating this software!!

Out of curiousity, is a distributed framework in the works for windows?