Brute force knowing some characters (but not their location)

[andreap]

as i said, this strongly depends on your hash, just take a look at a single NVIDIA GeForce RTX 3060 for md5
speed around 24645.8 MH/s, so in the case mentioned above this would result in a slight longer cracking ETA (maybe 3-5 seconds because of some overhead) but overall this few seconds are negligible

for the rest, no there is no command for that, you have to generate a maskfile like you already did for yourself containing all possibilities for this kind of attack, just put this into a file and use it as input for the mask, hashcat will handle each line as mask, running all of them step by step, the maskfile should look like this

9?l?l?l?l?l?l?l
?l9?l?l?l?l?l?l
?l?l9?l?l?l?l?l
?l?l?l9?l?l?l?l
?l?l?l?l9?l?l?l
?l?l?l?l?l9?l?l
?l?l?l?l?l?l9?l
?l?l?l?l?l?l?l9

Sounds good, sadly I'm using the 22000 (WPA-PBKDF2-PMKID+EAPOL) and it's a bit slow, hopefully good, thanks.