Cracking LM

[M@LIK]

Hi everyone,
I've noticed some very weird behaviors while playing with LM hashes.
So I generated some LM hashes:

Code:

0182BD0BD4444BF836077A718CCDF409:12345678 8C6F5D02DEB21501:ABC 1C3A2B6D939A1021:AAA

When trying to bruteforce these (In 16 bytes form or 32) I get either wrong cracked passwords or "Exhausted". Always, with some certain hashes.

Let's say this hash:

Code:

0182BD0BD4444BF836077A718CCDF409:12345678

Here we go:

Code:

hc64p -m3000 -a3 ..\M\LM.hash ?d?d?d?d?d?d?d?d ** Valid keyfile for beta usage: malik (expires 18.05.2013) cudaHashcat-plus v0.09 by atom starting... Hashes: 2 Unique digests: 2 Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes GPU-Loops: 32 GPU-Accel: 8 Password lengths range: 1 - 7 ... Device #1: Kernel ./kernels/4318/m3000_a3.sm_21.ptx 36077a718ccdf409:8 0182bd0bd4444bf8:1234467 Status.......: Cracked Input.Mode...: Mask (?d?d?d?d?d?d?d) Hash.Target..: 0182bd0bd4444bf836077a718ccdf409 Hash.Type....: LM Time.Running.: 0 secs Time.Util....: 964.5ms/1.5ms Real/CPU, 0.2% idle Speed........: 4512.0k c/s Real, 35682.4k c/s GPU Recovered....: 2/2 Digests, 1/1 Salts Progress.....: 4352000/10000000 (43.52%) Rejected.....: 0/4352000 (0.00%) HWMon.GPU.#1.: 0% Util, 45c Temp, -1rpm Fan Started: Mon May 28 18:36:43 2012 Stopped: Mon May 28 18:36:45 2012

Notice the second hash.


Another one:

Code:

8C6F5D02DEB21501:ABC

Code:

hc64p -m3000 -a3 -1 ?u?d ..\M\LM.hash ?1?1?1 ** Valid keyfile for beta usage: malik (expires 18.05.2013) cudaHashcat-plus v0.09 by atom starting... Hashes: 2 Unique digests: 2 Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes GPU-Loops: 32 GPU-Accel: 8 Password lengths range: 1 - 7 ... Device #1: Kernel ./kernels/4318/m3000_a3.sm_21.ptx 8c6f5d02deb21501:AAC Status.......: Exhausted Input.Mode...: Mask (?1?1?1) Hash.Target..: 00000000000000008c6f5d02deb21501 Hash.Type....: LM Time.Running.: 0 secs Time.Left....: 0 secs Time.Util....: 998.0ms/1.6ms Real/CPU, 0.2% idle Speed........: 46747 c/s Real, 10930.8k c/s GPU Recovered....: 1/2 Digests, 0/1 Salts Progress.....: 46656/46656 (100.00%) Rejected.....: 0/46656 (0.00%) HWMon.GPU.#1.: 0% Util, 45c Temp, -1rpm Fan Started: Mon May 28 18:39:42 2012 Stopped: Mon May 28 18:39:44 2012

One more?

Code:

1C3A2B6D939A1021:AAA

Code:

hc64p -m3000 -a3 -1 ?u?d ..\M\LM.hash ?1?1?1 ** Valid keyfile for beta usage: malik (expires 18.05.2013) cudaHashcat-plus v0.09 by atom starting... Hashes: 2 Unique digests: 2 Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes GPU-Loops: 32 GPU-Accel: 8 Password lengths range: 1 - 7 ... Device #1: Kernel ./kernels/4318/m3000_a3.sm_21.ptx Status.......: Exhausted Input.Mode...: Mask (?1?1?1) Hash.Target..: 00000000000000001c3a2b6d939a1021 Hash.Type....: LM Time.Running.: 0 secs Time.Left....: 0 secs Time.Util....: 997.8ms/1.6ms Real/CPU, 0.2% idle Speed........: 46757 c/s Real, 38278.6k c/s GPU Recovered....: 0/2 Digests, 0/1 Salts Progress.....: 46656/46656 (100.00%) Rejected.....: 0/46656 (0.00%) HWMon.GPU.#1.: 0% Util, 44c Temp, -1rpm Fan Started: Mon May 28 18:42:36 2012 Stopped: Mon May 28 18:42:37 2012

Not found!


At first I thought it's my generator which is the problem, I used EGB to make sure of that but, EGB cracked them all correctly!

Code:

LM bfLM.ini %hash% Maximum password length: 7 characters Number of GPU to be used: 1 Configuration file: "bfLM.ini" 36077a718ccdf409:8 0182bd0bd4444bf8:1234567 1c3a2b6d939a1021:AAA 8c6f5d02deb21501:ABC All passwords found! Time elapsed: 0d:0h:0m:1s.

Most if not all of these problems disappear when doing a dictiory attack:

Code:

hc64p -m3000 ..\M\LM.hash ..\M\Odic.dic ** Valid keyfile for beta usage: malik (expires 18.05.2013) cudaHashcat-plus v0.09 by atom starting... Hashes: 6 Unique digests: 5 Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes Rules: 1 GPU-Loops: 32 GPU-Accel: 8 Password lengths range: 1 - 7 ... Device #1: Kernel ./kernels/4318/m3000_a0.sm_21.ptx Scanned dictionary ..\M\Odic.dic: 20 bytes, 4 words, 4 keyspace, starting attack ... 36077a718ccdf409:8 aad3b435b51404ee: 8c6f5d02deb21501:ABC 1c3a2b6d939a1021:AAA 0182bd0bd4444bf8:1234567 Status.......: Cracked Input.Mode...: File (..\M\Odic.dic) Hash.Target..: File (..\M\LM.hash) Hash.Type....: LM Time.Running.: 0 secs Time.Util....: 994.9ms/0.0ms Real/CPU, 0.0% idle Speed........: 4 c/s Real, 0 c/s GPU Recovered....: 5/5 Digests, 1/1 Salts Progress.....: 4/4 (100.00%) Rejected.....: 0/4 (0.00%) HWMon.GPU.#1.: 0% Util, 38c Temp, -1rpm Fan Started: Mon May 28 19:16:21 2012 Stopped: Mon May 28 19:16:23 2012

Tried:
oclHashcat-plus-0.09b15
oclHashcat-plus-0.08
Similar results with oclHashcat-lite-0.10b49.

Am I doing something wrong? I don't think so.
I'm also amazed that nobody noticed this before. Or it's just me?