psafe3 (-m 5200)

[racfsnow]

I've been trying different hash types and have had some success, but still struggling with the psafe3 hash.

I donwloaded the hashcat.psafe3 sample from the website, which I can open using PasswordSafe and a password of 'hashcat', so far so good.

But when I try to confirm using oclhashcat (1.31) with the following command line, it fails to resolve? The file passwords.txt contains the word 'hashcat' so I'm confused?

oclhashcat64.exe" -m 5200 -a 0 hashcat.psafe3 passwords.txt

Can someone tell me what I'm missing please?

Thanks in advance.

[philsmd]

Do you mean this one http://hashcat.net/misc/example_hashes/hashcat.psafe3 ?

Please verify that the md5sum of the hashcat.psafe3 file is f5cfdc67d962e4d6604e4fbe9aa2f2db

Furthermore, pls try with:
oclhashcat64.exe -m 5200 hashcat.psafe3 -a 3 hashcat

It works here with ubuntu 14.04 + r9 290x (with oclHashcat 1.31 and latest beta).

[racfsnow]

Yes, I did download from the link you gave.

Yes, I can verify that the md5sum of the hashcat.psafe3 file is f5cfdc67d962e4d6604e4fbe9aa2f2db

Furthermore, pls try with:
oclhashcat64.exe -m 5200 hashcat.psafe3 -a 3 hashcat

Yes, when I try this command, it does indeed work.

That helps and I'm learning more all the time, but I'm struggling to understand how I can test the password using a wordlist? Was there something wrong with what I was trying to do initially?

Thanks again

Just looking a bit more at the differences in the output from these commands and I noticed the following, not sure what it means exactly?

This is part of the screen output from the -a 3 command which recovers the password

Device #1: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/m05200.Tahiti_1573.4_1573.4 (VM).kernel (169868 bytes)
Device #1: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/markov_le_v1.Tahiti_1573.4_1573.4 (VM).kernel (92388 bytes)
Device #1: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/bzero.Tahiti_1573.4_1573.4 (VM).kernel (30492 bytes)
Device #2: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/m05200.Tahiti_1573.4_1573.4 (VM).kernel (169868 bytes)
Device #2: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/markov_le_v1.Tahiti_1573.4_1573.4 (VM).kernel (92388 bytes)
Device #2: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/bzero.Tahiti_1573.4_1573.4 (VM).kernel (30492 bytes)

and this is part of the screen output from the -a 0 command which doesn't recover the password

Device #1: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/m05200.Tahiti_1573.4_1573.4 (VM).kernel (169868 bytes)
Device #1: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/bzero.Tahiti_1573.4_1573.4 (VM).kernel (30492 bytes)
Device #2: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/m05200.Tahiti_1573.4_1573.4 (VM).kernel (169868 bytes)
Device #2: Kernel C:\Program Files\oclHashcat-1.31/kernels/4098/bzero.Tahiti_1573.4_1573.4 (VM).kernel (30492 bytes)

[philsmd]

That means it is cracking correctly, therefore should also work with -a 0.

Please try to create a new dict.txt file with only the word "hashcat" in the first line and use it instead of the passwords.txt file.

Maybe your passwords.txt has some whitespace (spaces etc) at the end of the line?

[racfsnow]

Bingo - many thanks

there was indeed a space after the word 'hashcat'

working perfectly as expected, I'll be extra careful about spaces from now on.