need batch stop after pass found hccapx
#11
(01-28-2020, 03:58 PM)msalman Wrote: the pass is in my first wordlist
11223344

The attached hccapx file is a multi hash file. It contain 15 hashes (6 of them are dupes). If one of them is not recovered, hashcat will exhaust!
Code:
$ hashcat -m 2500 hamza.hccapx -a 3 11223344
hashcat (v5.1.0-1628-g424a6ee8) starting...

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
                                               
Session..........: hashcat
Status...........: Exhausted
Hash.Name........: WPA-EAPOL-PBKDF2
Hash.Target......: hamza.hccapx
Time.Started.....: Tue Jan 28 15:39:03 2020 (0 secs)
Time.Estimated...: Tue Jan 28 15:39:03 2020 (0 secs)
Guess.Mask.......: 11223344 [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:      41 H/s (0.71ms) @ Accel:8 Loops:128 Thr:1024 Vec:1
Recovered........: 4/9 (44.44%) Digests
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 1/1 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:8-17
Candidates.#1....: 11223344 -> 11223344
Hardware.Mon.#1..: Temp: 60c Fan: 48% Util: 53% Core:1860MHz Mem:5005MHz Bus:16

Started: Tue Jan 28 15:38:59 2020
Stopped: Tue Jan 28 15:39:05 2020

only 4 of 9 are recoverable running hashcat default options.

But all of them are recoverable by activating nonce-error-corrections:
Code:
$ hashcat -m 2500 --nonce-error-corrections=128 hamza.hccapx -a 3 11223344
hashcat (v5.1.0-1628-g424a6ee8) starting...

c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
c83a3557d2d1:a8515b2b3452:PTCL_L2 290:11223344 
                                               
Session..........: hashcat
Status...........: Cracked
Hash.Name........: WPA-EAPOL-PBKDF2
Hash.Target......: hamza.hccapx
Time.Started.....: Tue Jan 28 15:41:30 2020 (0 secs)
Time.Estimated...: Tue Jan 28 15:41:30 2020 (0 secs)
Guess.Mask.......: 11223344 [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:      11 H/s (0.71ms) @ Accel:8 Loops:128 Thr:1024 Vec:1
Recovered........: 9/9 (100.00%) Digests
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:8-17
Candidates.#1....: 11223344 -> 11223344
Hardware.Mon.#1..: Temp: 57c Fan: 43% Util: 63% Core:1860MHz Mem:5005MHz Bus:16

Started: Tue Jan 28 15:41:26 2020
Stopped: Tue Jan 28 15:41:32 2020

Which tool did you use to capture the traffic?
Which tool did you use to convert the handshakes?
Can you please attach the cap file?
Reply


Messages In This Thread
RE: need batch stop after pass found hccapx - by ZerBea - 01-28-2020, 04:44 PM