(07-03-2014, 08:00 AM)philsmd Wrote: First of all, the topic of this thread is really disgusting.
The problem at the other hand, is very easy and you should probably easy understand it (indeed here: https://hashcat.net/forum/thread-3518-po...l#pid20148 you even say that you have the code to produce it)... While Double SHA1 (and Double MD5 etc) are using the hex representation as input for the second round (i.e. sha1_hex (sha1_hex ($pass))), the algo that is used in your example is very different (i.e. sha1_hex (sha1 (encode ("UTF-16LE", $pass)))).
Note the difference between hex representation and binary represenation (=> input to second sha1_hex call)
So I don't know if you can say you beated hashcat with an algorithm that is totally different (and currently not supported).
Hope this helps to understand why the results are different
Ps. NULL bytes are no problem for *hashcat at all, but if you try some hashes that were generated w/ a very different hash algo you ofc can't recover them w/ Double SHA1
Hiyah!
> the algo that is used in your example is very different (i.e. sha1_hex (sha1 (encode ("UTF-16LE", $pass)))).
The command I used in my post should do that algorithm for the limited situation I've given. (ASCII A, B, C)
>Note the difference between hex representation and binary represenation (=> input to second sha1_hex call)
The code I've posted to Radix shows the hashing algorithm I used in detail. The hashes are SHA1(SHA1()) - it's just converted to ASCII to post here.
Radix posted that he was able to find the password - but he used a single SHA1 pass, with a hash I didn't give in my examples. =)
But - his command parameters are very similar to mine (apart from the -m 4500) so my usage appears sound.
From the commands he uses, he must be using Linux, or Unix... perhaps I'm seeing a unique bug on the Windows version?
I wanted to check my setup is correct before calling it/reporting it though.