Office international character problem
#3
(06-30-2019, 08:26 PM)3Pi0 Wrote: use instead
hashcat -a3 -m9600 doc.hash ?b

Sorry I gave the wrong example. You're right about the example I gave in my previous message.

But, there is actually a problem for some characters like 'ş'.
The password of the word document is just 'ş'. The hash is as follows:

$office$*2010*100000*128*16*3dab60c78beaeac33901cb587f2f7c1c*f4edb827473160c0eb9c1d07cb4c2a83*d1372637fd0b2c45d41452c9667086cd7acee09da3858c9a6d12bd70ecd94675

JTR can crack it like I said before using the following command line:
john --mask=?b?b doc.hash
john --wordlist=utf-8.dict doc.hash

Hashcat cannot crack it. None of the single-byte mask, double-byte mask, dictionary utf-8, dictionary iso-8859-9 attacks work. The tried command lines are as follows:

hashcat -a3 -m9500 doc.hash ?b
hashcat -a3 -m9500 doc.hash ?b?b
hashcat -a0 -m9500 doc.hash utf-8.dict
hashcat -a0 -m9500 doc.hash iso-8859-9.dict

None of the above works.

utf-8.dict contains single line with character 'ş' (HEX C59F) on it
iso-8859-9.dict contains single line with character 'ş' (HEX FE) on it
Reply


Messages In This Thread
RE: Office international character problem - by hansel - 07-01-2019, 01:19 PM