05-10-2024, 03:34 PM
Hello,
I have not found it documented that hashcat automatically strips /r (CR) characters but it seems to be doing so. I have been going under my apparently old understanding that, when present, /r needed to be removed manually (dos2unix, or similar).
The steps I used to test this are:
1. I created two wordlists, nixlist and winlist with the same words. On each line in winlist I manually added carriage returns (/r) using CTRL-V CTRL-M in vim (I didn't have a Windows computer handy to make the file).
2. I confirmed the wordlist file structure using hexdump.
3. I manually hashed nixlist and winlist with openssl to confirm the /r was causing hashes to be different.
4. I then created a hashlist by hashing nixlist and saved it to a file named hashlist.
5. Next I ran hashcat on hashlist using winlist as the wordlist. Before doing so I made sure hashcat.potfile was empty and I also manually set the poftile to local.potfile.
I was surprised to see that the winlist wordlist successfully recovered passwords in the nixlist-based hashlist. This suggests that hashcat is stripping /r.
Can someone confirm this or specify my error? If it is documented somewhere, can you point me to that link?
Command output:
Thank you for any help you can offer.
I have not found it documented that hashcat automatically strips /r (CR) characters but it seems to be doing so. I have been going under my apparently old understanding that, when present, /r needed to be removed manually (dos2unix, or similar).
The steps I used to test this are:
1. I created two wordlists, nixlist and winlist with the same words. On each line in winlist I manually added carriage returns (/r) using CTRL-V CTRL-M in vim (I didn't have a Windows computer handy to make the file).
2. I confirmed the wordlist file structure using hexdump.
3. I manually hashed nixlist and winlist with openssl to confirm the /r was causing hashes to be different.
4. I then created a hashlist by hashing nixlist and saved it to a file named hashlist.
5. Next I ran hashcat on hashlist using winlist as the wordlist. Before doing so I made sure hashcat.potfile was empty and I also manually set the poftile to local.potfile.
I was surprised to see that the winlist wordlist successfully recovered passwords in the nixlist-based hashlist. This suggests that hashcat is stripping /r.
Can someone confirm this or specify my error? If it is documented somewhere, can you point me to that link?
Command output:
Quote:❯ cat winlist
hello
goodbye
lucky
snake
Quote:❯ hexdump -c winlist
0000000 h e l l o \r \n g o o d b y e \r \n
0000010 l u c k y \r \n s n a k e \r \n \n
000001f
Quote:❯ for word in $(cat winlist); do echo -n "$word" | openssl sha1; done | awk '{print $2}'
e5ad4d3134d03e6bfc4de4f046c7c5d0b52962a5
ad928c1e055bbb0858c452b0d43b3740e53adc31
913e3490a7bf1ad10957f3073c8ea7e02f85bda0
9316338a5ff32b8172cb80d6b92dd6e8708ce46e
Quote:❯ cat nixlist
hello
goodbye
lucky
snake
Quote:❯ hexdump -c nixlist
0000000 h e l l o \n g o o d b y e \n l u
0000010 c k y \n s n a k e \n
000001a
Quote:❯ for word in $(cat nixlist); do echo -n "$word" | openssl sha1; done | awk '{print $2}'
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
3c8ec4874488f6090a157b014ce3397ca8e06d4f
1ce1416347075b6070a35ce5e9d26b61d91ea6c3
148627088915c721ccebb4c611b859031037e6ad
Quote:❯ hashcat -m 100 -a 0 --potfile-path=local.potfile hashlist winlist
hashcat (v6.2.6) starting
<--truncated-->
Approaching final keyspace - workload adjusted.
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d:hello
3c8ec4874488f6090a157b014ce3397ca8e06d4f:goodbye
1ce1416347075b6070a35ce5e9d26b61d91ea6c3:lucky
148627088915c721ccebb4c611b859031037e6ad:snake
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 100 (SHA1)
Hash.Target......: hashlist
Time.Started.....: Fri May 10 08:57:18 2024 (0 secs)
Time.Estimated...: Fri May 10 08:57:18 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (winlist)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 4682 H/s (0.03ms) @ Accel:1024 Loops:1 Thr:64 Vec:1
Recovered........: 4/4 (100.00%) Digests (total), 4/4 (100.00%) Digests (new)
Progress.........: 5/5 (100.00%)
Rejected.........: 0/5 (0.00%)
Restore.Point....: 0/5 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: hello ->
Hardware.Mon.#1..: Util: 89%
Started: Fri May 10 08:57:18 2024
Stopped: Fri May 10 08:57:19 2024
Quote:❯ cat local.potfile
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d:hello
3c8ec4874488f6090a157b014ce3397ca8e06d4f:goodbye
1ce1416347075b6070a35ce5e9d26b61d91ea6c3:lucky
148627088915c721ccebb4c611b859031037e6ad:snake
Thank you for any help you can offer.