cant decrypt ecryptfs hashstring

[matt99]

I used the tool ecryptfs2john to create a hash string from my ecryptfs wrapped-passphrase file - hashcat seems to use this format.

https://github.com/magnumripper/JohnTheR...fs2john.py



The plaintext password is "geheim123". So i get

Code:

$ecryptfs$0$1$af5329101a193c34$9a466af1ffe571e0

My wrapped-passphrase looks like this (hexdump wrapped-passphrase -C):

Code:

00000000  3a 02 af 53 29 10 1a 19  3c 34 39 61 34 36 36 61  |:..S)...<49a466a|

00000010  66 31 66 66 65 35 37 31  65 30 2f 9c 74 4c 66 90  |f1ffe571e0/.tLf.|

00000020  c2 e2 db a3 a3 a5 17 21  89 d9 82 63 9e 42 db 5d  |.......!...c.B.]|

00000030  96 5b 29 b8 bf e2 67 fa  49 e2                    |.[)...g.I.|

0000003a

So i run hashcat with the following parameters:

Code:

hashcat64.exe -a0 -m 12200 encryptfs.txt pw.txt

But i only get 'Exhausted':

Code:

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: eCryptfs
Hash.Target......: $ecryptfs$0$1$af5329101a193c34$9a466af1ffe571e0
Time.Started.....: Wed Jun 24 14:21:11 2020 (1 sec)
Time.Estimated...: Wed Jun 24 14:21:12 2020 (0 secs)
Guess.Base.......: File (pw.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:        0 H/s (2.00ms)
Speed.Dev.#*.....:        0 H/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Candidates.#1....: geheim123 -> geheim123
HWMon.Dev.#1.....: Temp: 31c Fan: 28% Util: 95% Core:1911MHz Mem:4513MHz Bus:16