02-17-2017, 06:45 PM
You'll need to be realistic about your odds. You can improve them a bit, but it will take some work.
Office 2013 hashes are extremely slow. On my GTX 970, I only get about 4000 hashes per second once I start supplying a lot of work.
Also, note that your command line should explicitly specify the actual mask (these are not tested, just examples):
hashcat64.exe -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 my_word_hash.txt ?1?1?1?1?1?1?1?1
When you start the run, you'll see that it starts with the four-character mask first (?1?1?1?1). Let it run for 20 seconds or so, then hit Enter to refresh status, and then note the time estimate. Then hit 'b' for 'bypass' to repeat the procedure to see the time estimate for five characters, etc. Once you get above 6 chars, you'll see that it's going to take a very long time.
hashcat --session=t2 -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 o13.hash ?1?1?1?1?1?1?1?1
hashcat (v3.30-310-g30e3ad6) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 970, 1009/4036 MB allocatable, 13MCU
* Device #2: GeForce GTX 750 Ti, 500/2000 MB allocatable, 5MCU
[snip]
Session..........: t2
Status...........: Running
Hash.Type........: Office 2013
Hash.Target......: $office$*2013*100000*256*16*7dd611d7eb4c899f74816d1dec817b3b*948dc0b2c2c6c32f14b5995a543ad037*0b7ee0e48e935f937192a59de48a7d561ef2691d5c8a3ba87ec2d04402a94895
Time.Started.....: Fri Feb 17 07:27:37 2017 (10 secs)
Time.Estimated...: Fri Feb 17 07:33:53 2017 (6 mins, 6 secs)
Input.Mask.......: ?1?1?1?1 [4]
Input.Charset....: -1 ?l?d, -2 Undefined, -3 Undefined, -4 Undefined
Input.Queue......: 1/5 (20.00%)
Speed.Dev.#1.....: 3382 H/s (3.16ms)
Speed.Dev.#2.....: 1193 H/s (3.39ms)
Speed.Dev.#*.....: 4571 H/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 0/1679616 (0.00%)
Rejected.........: 0/0 (0.00%)
Restore.Point....: 0/46656 (0.00%)
Candidates.#1....: sari -> sqg4
Candidates.#2....: sar0 -> sqgq
HWMon.Dev.#1.....: Temp: 48c Fan: 35% Util: 99% Core:1265Mhz Mem:3004Mhz Lanes:8
HWMon.Dev.#2.....: Temp: 34c Fan: 32% Util: 99% Core:1163Mhz Mem:2700Mhz Lanes:8
[snip]
Time.Started.....: Fri Feb 17 07:27:50 2017 (2 secs)
Time.Estimated...: Fri Feb 17 11:55:27 2017 (4 hours, 27 mins)
Input.Mask.......: ?1?1?1?1?1 [5]
[snip]
Time.Started.....: Fri Feb 17 07:28:03 2017 (11 secs)
Time.Estimated...: Wed Feb 22 12:37:08 2017 (5 days, 5 hours)
Input.Mask.......: ?1?1?1?1?1 [6]
[snip]
Time.Started.....: Fri Feb 17 07:32:49 2017 (24 secs)
Time.Estimated...: Sat Aug 19 20:44:03 2017 (183 days, 12 hours)
Input.Mask.......: ?1?1?1?1?1?1?1 [7]
You can reduce this a little bit by generating a list of masks that only have at most one digit in them, and feeding that list to hashcat. The PACK toolkit (Python) has a tool called 'policygen' to do this:
./policygen.py --pps 4000 --minlength=4 --maxlength=8 --mindigit=1 --maxdigit=1 --maxspecial=0 --showmasks >masks.txt
You can then specify the masks.txt filename instead of the mask:
hashcat64.exe -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 my_word_hash.txt masks.txt
If there's anything else that you can recall about the password, try to reduce the keyspace as much as you can. Good luck!
Office 2013 hashes are extremely slow. On my GTX 970, I only get about 4000 hashes per second once I start supplying a lot of work.
Also, note that your command line should explicitly specify the actual mask (these are not tested, just examples):
hashcat64.exe -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 my_word_hash.txt ?1?1?1?1?1?1?1?1
When you start the run, you'll see that it starts with the four-character mask first (?1?1?1?1). Let it run for 20 seconds or so, then hit Enter to refresh status, and then note the time estimate. Then hit 'b' for 'bypass' to repeat the procedure to see the time estimate for five characters, etc. Once you get above 6 chars, you'll see that it's going to take a very long time.
hashcat --session=t2 -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 o13.hash ?1?1?1?1?1?1?1?1
hashcat (v3.30-310-g30e3ad6) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 970, 1009/4036 MB allocatable, 13MCU
* Device #2: GeForce GTX 750 Ti, 500/2000 MB allocatable, 5MCU
[snip]
Session..........: t2
Status...........: Running
Hash.Type........: Office 2013
Hash.Target......: $office$*2013*100000*256*16*7dd611d7eb4c899f74816d1dec817b3b*948dc0b2c2c6c32f14b5995a543ad037*0b7ee0e48e935f937192a59de48a7d561ef2691d5c8a3ba87ec2d04402a94895
Time.Started.....: Fri Feb 17 07:27:37 2017 (10 secs)
Time.Estimated...: Fri Feb 17 07:33:53 2017 (6 mins, 6 secs)
Input.Mask.......: ?1?1?1?1 [4]
Input.Charset....: -1 ?l?d, -2 Undefined, -3 Undefined, -4 Undefined
Input.Queue......: 1/5 (20.00%)
Speed.Dev.#1.....: 3382 H/s (3.16ms)
Speed.Dev.#2.....: 1193 H/s (3.39ms)
Speed.Dev.#*.....: 4571 H/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 0/1679616 (0.00%)
Rejected.........: 0/0 (0.00%)
Restore.Point....: 0/46656 (0.00%)
Candidates.#1....: sari -> sqg4
Candidates.#2....: sar0 -> sqgq
HWMon.Dev.#1.....: Temp: 48c Fan: 35% Util: 99% Core:1265Mhz Mem:3004Mhz Lanes:8
HWMon.Dev.#2.....: Temp: 34c Fan: 32% Util: 99% Core:1163Mhz Mem:2700Mhz Lanes:8
[snip]
Time.Started.....: Fri Feb 17 07:27:50 2017 (2 secs)
Time.Estimated...: Fri Feb 17 11:55:27 2017 (4 hours, 27 mins)
Input.Mask.......: ?1?1?1?1?1 [5]
[snip]
Time.Started.....: Fri Feb 17 07:28:03 2017 (11 secs)
Time.Estimated...: Wed Feb 22 12:37:08 2017 (5 days, 5 hours)
Input.Mask.......: ?1?1?1?1?1 [6]
[snip]
Time.Started.....: Fri Feb 17 07:32:49 2017 (24 secs)
Time.Estimated...: Sat Aug 19 20:44:03 2017 (183 days, 12 hours)
Input.Mask.......: ?1?1?1?1?1?1?1 [7]
You can reduce this a little bit by generating a list of masks that only have at most one digit in them, and feeding that list to hashcat. The PACK toolkit (Python) has a tool called 'policygen' to do this:
./policygen.py --pps 4000 --minlength=4 --maxlength=8 --mindigit=1 --maxdigit=1 --maxspecial=0 --showmasks >masks.txt
You can then specify the masks.txt filename instead of the mask:
hashcat64.exe -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 my_word_hash.txt masks.txt
If there's anything else that you can recall about the password, try to reduce the keyspace as much as you can. Good luck!
~