Mask only working partially

[pdo]

Working OK for me on 6.2.5 (Linux)

44da7fcbc0465ea5a5938f5d9c695253:9aded09afa5f:b4e1eb20d94c:TEST_AP:asdfPWD1

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: pmkid-only
Time.Started.....: Fri Jan 14 00:09:10 2022 (0 secs)
Time.Estimated...: Fri Jan 14 00:09:10 2022 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: asdf?u?u?u1 [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  575.4 kH/s (0.56ms) @ Accel:16 Loops:128 Thr:256 Vec:1
Speed.#2.........:  181.9 kH/s (0.67ms) @ Accel:16 Loops:128 Thr:256 Vec:1
Speed.#*.........:  757.3 kH/s
Recovered........: 1/1 (100.00%) Digests
Progress.........: 17576/17576 (100.00%)
Rejected.........: 0/17576 (0.00%)
Restore.Point....: 0/17576 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: asdfANA1 -> asdfESR1
Candidates.#2....: asdfSOA1 -> asdfXQJ1
Hardware.Mon.#1..: Temp: 40c Fan: 60% Util:  3% Core:1995MHz Mem:7500MHz Bus:16
Hardware.Mon.#2..: Temp: 36c Fan: 20% Util: 41% Core:1905MHz Mem:6800MHz Bus:16

Started: Fri Jan 14 00:07:54 2022
Stopped: Fri Jan 14 00:09:12 2022

hashcat --sdtout -a 3 asdf?u?u?u1 > test.dict

and searched for your PW and it was inside this generated dict

Thanks for the command example. I am sure it generates the right password, just for some reason it fails to register that it actually matches the hash.

which version of hashcat do you use?

6.1.1

could you try this command? (without quotationmarks and in the right order) i know hashcat is quite generous but you should follow this input style

hashcat [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]



hashcat -m 22000 -a 3 pmkid-only asdf?u?u?u1

It didn't, although I had to escape the ? to make it work in zsh. But it definitely produces the expected password when ran with --stdout param. Not sure what's going on here.

I assume you were able to run hashcat on a file with the hash that I posted and it produced the password?