OK, this is ugly as heck, and buggy (it doesn't fully emulate bruteforce for the last two characters), but it's getting close:
The idea here - borrowing in part from the "hybrid attack with rules" wiki page - is to generate the last two characters on GPU, using a generated list of rules. Basically, I'm doubling the word that is being input from stdin, and then inserting specific characters at positions 6, 7, 15, and 16.
My first-attempt script isn't covering all of the characters properly, and generates some bogus rules, but you get the idea.
Code:
$ for item in `mp64 '?aTEMP?a'`; do echo "di6${item}iE${item}"; done | sed 's/TEMP/i7/;s/TEMP/iF/' >dupedouble.rule
$ wc -l dupedouble.rule
9025 dupedouble.rule
$ head dupedouble.rule
di6i7iEiF [this one is bogus]
di6i7!iEiF!
di6i7"iEiF"
di6i7#iEiF#
di6i7$iEiF$
di6i7%iEiF%
di6i7&iEiF&
di6i7'iEiF'
di6i7(iEiF(
di6i7)iEiF)
$ mp64 ?a?a?a?a?a?a | hashcat -w 4 -a 0 -O -r dupedouble.rule
Candidates.#1....: !~UjRe) !~UjRe) -> "%`cegl "%`cegl
Candidates.#2....: "1vV/!! "1vV/!! -> "8"OB"G "8"OB"G
Candidates.#3....: !xJq>}X !xJq>}X -> !~UjQ~~ !~UjQ~~
Candidates.#4....: !r?x*}X !r?x*}X -> !xJq=~~ !xJq=~~
Candidates.#5....: "%`cf!! "%`cf!! -> "+k\y"G "+k\y"G
Candidates.#6....: "+k\z!! "+k\z!! -> "1vV."G "1vV."GThe idea here - borrowing in part from the "hybrid attack with rules" wiki page - is to generate the last two characters on GPU, using a generated list of rules. Basically, I'm doubling the word that is being input from stdin, and then inserting specific characters at positions 6, 7, 15, and 16.
My first-attempt script isn't covering all of the characters properly, and generates some bogus rules, but you get the idea.
~