hcxtools - solution for capturing wlan traffic and conversion to hashcat formats

[oayz]

Hi ZerBea,

Could you please check what's wrong with hcxhashtool converting HC22000 to JtR? Sometimes it doesn't output "ssid:$WPAPSK$essid" part, JtR's hast start with PKMID:

HC22000 hash (nokopiallow.hc22000):
WPA*01*4b59ba28ed4cd75df672f5407a4204db*3c3786b931b5*b0ece1e0cb27*6e6f6b6f7069616c6c6f77***01

Running hcxhashtool.exe -i nokopiallow.hc22000 --info=nokopiallow.info:
SSID.......: nokopiallow
MAC_AP.....: 3c3786b931b5 (Unknown)
MAC_CLIENT.: b0ece1e0cb27 (Unknown)
PMKID......: 4b59ba28ed4cd75df672f5407a4204db
HASHLINE...: WPA*01*4b59ba28ed4cd75df672f5407a4204db*3c3786b931b5*b0ece1e0cb27*6e6f6b6f7069616c6c6f77***

Running hcxhashtool -i nokopiallow.hc22000 --john=nokopiallow.john:
4b59ba28ed4cd75df672f5407a4204db*3c3786b931b5*b0ece1e0cb27*6e6f6b6f7069616c6c6f77

Expected nokopiallow.john is:
$wpapsk$nokopiallow*4b59ba28ed4cd75df672f5407a4204db*3c3786b931b5*b0ece1e0cb27*6e6f6b6f7069616c6c6f77

There is also problem #2 - "normally" generated john hashes also seems to be wrong:
Tinni:$WPAPSK$Tinni#j7eCffK2b5M ...
instead of expected
$WPAPSK$Tinni*j7eCffK2b5M ...

And to keep you busy :-) trying to convert the same nokopiallow.hc22000 to cap and then to john:
hcxhash2cap.exe -c nokopiallow.cap --pmkid-eapol=nokopiallow.hc22000
wpapcap2john.exe nokopiallow.cap  > nokopiallow.john

Results in another misformatted john hash:
nokopiallow:4b59ba28ed4cd75df672f5407a......c3786b931b5:MKID:nokopiallow.cap

Am I doing something wrong?