Charset files don't behave as expected?
#1
I have a hash of encrypted with Cyrillic password - "хуй", three characters long. 

whenever I'm trying to use charset file, it fails to crack it. 

official encoding file
Code:
>hashcat -d 4 -m 11300 -a 3 --custom-charset1 /home/maxim/tmp/hashcat-6.1.1/charsets/standard/Russian/ru_cp1251.hcchr bt_wallet_huy.hash ?1?1?1 Session..........: hashcat Status...........: Exhausted Hash.Name........: Bitcoin/Litecoin wallet.dat Hash.Target......: $bitcoin$96$79e09876f9674db8e947bb8713ea5f9a14dc1be...5d1b88 Time.Started.....: Mon Apr 19 14:53:21 2021 (10 secs) Time.Estimated...: Mon Apr 19 14:53:31 2021 (0 secs) Guess.Mask.......: ?1?1?1 [3] Guess.Charset....: -1 custom.hccrs, -2 Undefined, -3 Undefined, -4 Undefined Guess.Queue......: 1/1 (100.00%) Speed.#4.........:      13 H/s (3.82ms) @ Accel:2 Loops:256 Thr:1024 Vec:1 Recovered........: 0/1 (0.00%) Digests Progress.........: 125/125 (100.00%) Rejected.........: 0/125 (0.00%) Restore.Point....: 25/25 (100.00%) Restore.Sub.#4...: Salt:0 Amplifier:4-5 Iteration:131328-131446 Candidates.#4....: $HEX[b9b985] -> $HEX[b9d1d1] Hardware.Mon.#4..: Temp: 47c Fan:  0% Util: 99% Core:1987MHz Mem:3802MHz Bus:8

or with my custom file like this: 

Code:
Only those characters in hcchr file >cat custom.hcchr хуй >hashcat -d 4 -m 11300 -a 3 --custom-charset1 custom.hcchr bt_wallet_huy.hash ?1?1?1 Session..........: hashcat Status...........: Exhausted Hash.Name........: Bitcoin/Litecoin wallet.dat Hash.Target......: $bitcoin$96$79e09876f9674db8e947bb8713ea5f9a14dc1be...5d1b88 Time.Started.....: Mon Apr 19 14:53:21 2021 (10 secs) Time.Estimated...: Mon Apr 19 14:53:31 2021 (0 secs) Guess.Mask.......: ?1?1?1 [3] Guess.Charset....: -1 custom.hcchr, -2 Undefined, -3 Undefined, -4 Undefined Guess.Queue......: 1/1 (100.00%) Speed.#4.........:      13 H/s (3.82ms) @ Accel:2 Loops:256 Thr:1024 Vec:1 Recovered........: 0/1 (0.00%) Digests Progress.........: 125/125 (100.00%) Rejected.........: 0/125 (0.00%) Restore.Point....: 25/25 (100.00%) Restore.Sub.#4...: Salt:0 Amplifier:4-5 Iteration:131328-131446 Candidates.#4....: $HEX[b9b985] -> $HEX[b9d1d1] Hardware.Mon.#4..: Temp: 47c Fan:  0% Util: 99% Core:1987MHz Mem:3802MHz Bus:8

See how candidates are shown in HEX? even though my terminal is same encoding as charset file and password ? 

but whenever I substitute ?1 with double ?1?1 per character (russian encoding is xxxx hex codes) I'm able to find password?!


Code:
>hashcat -d 4 -m 11300 -a 3 --custom-charset1 custom.[color=#333333][size=small][font=Tahoma, Verdana, Arial, sans-serif]hcchr[/font][/size][/color] bt_wallet_huy.hash ?1?1?1?1?1?1 Session..........: hashcat Status...........: Cracked Hash.Name........: Bitcoin/Litecoin wallet.dat Hash.Target......: $bitcoin$96$79e09876f9674db8e947bb8713ea5f9a14dc1be...5d1b88 Time.Started.....: Mon Apr 19 14:53:53 2021 (3 secs) Time.Estimated...: Mon Apr 19 14:53:56 2021 (0 secs) Guess.Mask.......: ?1?1?1?1?1?1 [6] Guess.Charset....: -1 custom.[color=#333333][size=small][font=Tahoma, Verdana, Arial, sans-serif]hcchr[/font][/size][/color], -2 Undefined, -3 Undefined, -4 Undefined Guess.Queue......: 1/1 (100.00%) Speed.#4.........:    1706 H/s (1.75ms) @ Accel:4 Loops:128 Thr:1024 Vec:1 Recovered........: 1/1 (100.00%) Digests Progress.........: 6250/15625 (40.00%) Rejected.........: 0/6250 (0.00%) Restore.Point....: 0/3125 (0.00%) Restore.Sub.#4...: Salt:0 Amplifier:1-2 Iteration:131328-131446 Candidates.#4....: $HEX[d1b98583d183] -> $HEX[d1d1d1d1d1d1] Hardware.Mon.#4..: Temp: 52c Fan:  0% Util: 98% Core:1987MHz Mem:3802MHz Bus:8


So why mask behaves like I'm using --hex-charset when charset is actual characters? 

Thanks
Reply


Messages In This Thread
Charset files don't behave as expected? - by bbcjared - 04-19-2021, 10:08 PM