Office and --show option

[Mem5]

You forgot to also include the command you execute for -m 9820. It also must contaiin the --username switch.

Yes it did contain username switch:

Code:

hashcat -m 9820 --username -a 3 -w 3 res_2.txt ?a?a?a?a?a?a?a -o res_3.txt
Hashfile 'res_2.txt' on line 1 (user:$oldoffice$3*xxx:$HEX[17ddb2271d]): Line-length exception

I do not understand why this
$oldoffice$3*xxx:17ddb2271d
was converted in
$oldoffice$3*xxx:$HEX[17ddb2271d]

Me too!

You also should use -m 9810 --show (and not -m 9800 --show).

Indeed, but same issue :

Code:

hashcat -m 9810 --show --username  hash.txt
user:$oldoffice$3*xxx:244845585b313764646232323731645d

244845585b313764646232323731645d is hexadecimal for $HEX[17ddb2271d]

And this hash is rejected by mode 9820 (even with username)

Code:

hashcat -m 9820 --username -a 3 -w 3 res_2.txt ?a?a?a?a?a?a?a -o res_3.txt
Hashfile 'res_2.txt' on line 1 (user:$oldoffice$3*xxx:244845585b313764646232323731645d): Line-length exception

I guess mode 9820 only allow $oldoffice$3*xxx:17ddb2271d but not $HEX[17ddb2271d] nor 244845585b313764646232323731645d