NTLM vs WPA/WPA2 cracking

[mtnsec]

Thanks for the quick response philsmd! Unfortunately, stdin does not appear to bypass the character limitation. Using a dictionary of just 3 words (all less than 8 characters) results in a very quick exit (output below). 3 words, 30000 rules, 90000 rejects.

Attempting to use -j/-k basically requires a while loop to iteratively run hashcat for every rule. Adding in initializing time for each run is just not practical for more than say, 500 hundred rules (which would still take ~7 hours on a 450k dictionary and using 3 1080’s). I’m also seeing hashing speed dropping by 20-30% this way.

So the only realistic remaining option is pre-generated rule based dictionaries which is presenting major storage issues. Still, I have also been working on this for the last few days. Definitely not optimal.

Maybe I just don’t realize what I’m asking for, but I don’t understand what the problems would be for testing a candidate with less characters as undeath points out. If there is not a real technical concern other than performance, I’d really like to test for myself. Admittedly I don’t have much programming background, but if someone could provide a hint as to where to look to modify the character input limitation in the source (even just to change from 8 to 5) for mode 2500 I would appreciate it. Would like to test and see what kind of a hit performance takes, or if it causes any other problems!

Thanks!

hasher@hash01:~$ sudo hashcat-4.2.1/hashcat64.bin -m 2500 test.hccapx -r hashcat-4.2.1/rules/rockyou-30000.rule < test3.txt
hashcat (v4.2.1) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #2: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU

Hashes: 17 digests; 9 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 30000

Applicable optimizers:
* Zero-Byte
* Single-Salt
* Slow-Hash-SIMD-LOOP

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63

Watchdog: Temperature abort trigger set to 90c

Starting attack in stdin mode...

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: WPA-EAPOL-PBKDF2
Hash.Target......: test.hccapx
Time.Started.....: Fri Aug 31 18:06:39 2018 (1 sec)
Time.Estimated...: Fri Aug 31 18:06:40 2018 (0 secs)
Guess.Base.......: Pipe
Guess.Mod........: Rules (hashcat-4.2.1/rules/rockyou-30000.rule)
Speed.Dev.#1.....: 0 H/s (0.00ms) @ Accel:32 Loops:16 Thr:1024 Vec:1
Speed.Dev.#2.....: 0 H/s (0.00ms) @ Accel:32 Loops:16 Thr:1024 Vec:1
Speed.Dev.#3.....: 0 H/s (0.00ms) @ Accel:32 Loops:16 Thr:1024 Vec:1
Speed.Dev.#*.....: 0 H/s
Recovered........: 0/9 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 90000
Rejected.........: 90000
Restore.Point....: 0
Candidates.#1....: [Copying]
Candidates.#2....: [Copying]
Candidates.#3....: [Copying]
HWMon.Dev.#1.....: Temp: 44c Fan: 27% Util: 0% Core:1898MHz Mem:4513MHz Bus:16
HWMon.Dev.#2.....: Temp: 43c Fan: 27% Util: 27% Core:1771MHz Mem:4513MHz Bus:16
HWMon.Dev.#3.....: Temp: 47c Fan: 29% Util: 0% Core:1898MHz Mem:4513MHz Bus:16

Started: Fri Aug 31 18:06:14 2018
Stopped: Fri Aug 31 18:06:40 2018