how can I set the mask to a md5 hash result of itself?

[yuzo555]

md5(abcd[salt])=0efa706032b161be6802d5ae093a97cd
what we know is the [salt] consists of 32 characters ( 0123456789abcdef ), seems like a md5 hash.
now I want crack this salt,
if I try to do this:

Code:

hashcat64 md5_hash.txt -m 0 -a 3 abcd?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h

I think it's impossible.


Sometime the [salt] was created by md5(a simple str),
in fact, in this case, the [salt] is md5(simple) = 8dbdda48fb8748d6746f1965824e966a


So, my question is, how can I set the mask to a md5 hash result of itself?
suck as...
hashcat64 md5_hash.txt -m 0 -a 3 abcd[md5(?s?s?s?s?s?s)]