Custom Ruleset, Correct word but exhausted
#5
I discovered several problems here:

1. This command makes absolutely no sense:
Code:
hashcat64.exe -w 1 -m 2500 -a 0 -r rules\mine.rule C:\Pen\hs\mywifi.hccap C:\Pen\word\test.txt --stdout --gpu-temp-retain=66

What it does is use the .hccap file and apply rules to that binary file.

To summarize, these command line arguments make no sense here:
* -m 2500: --stdout does not need any hash type since --stdout is not used to crack hashes
* C:\Pen\hs\mywifi.hccap: this normally suggests that the file is a hashcat cap file and therefore in binary format. It can be seen as a "hash file" and therefore shouldn't be there at all when you use --stdout
* --gpu-temp-retain=66: This argument will enable monitoring of your GPU and since --stdout does use your CPU only it also doesn't make sense at all and should be omitted

2. You say that you are trying to crack "Password431" (without quotes) but at the same time you say "I tried generating my own rules for the 4 digit and also (seperately) tried using KoreLogicRulesAppend4Num.rule". I see a problem here, the password that you want to crack only has 3 digits. It can't be crack with a rule file that appends 4 numbers.

3. You ask "why is it trying 2000 guesses when it should only be 1000 guesses", but later on you say that the content of your word list contains 2 words "password" and "Password" (both without quotes). Those 2 words multiplied by 1000 rules would end up with 2000 password candidates. So everything seems to be fine.

Maybe exactly this is your problem, i.e. you don't understand what the toggle rule does: it changes an uppercase letter to a lowercase one, and vice versa, i.e. if the letter is already lowercased it will be uppercased.
That means, if you only have "Password" within your word list and apply the rule "T0$4$3$1" it will end up trying the password candidate "password431" which doesn't match "Password431" (because the first character is lowercase but should be uppercase to be cracked).
I suspect that you are experiencing some problem like this.

Why do you not try a much more simple/minimal example and investigate and perform more test starting with this e.g.:

md5hash.txt:
Code:
1090d12545fd444f0a70d617d69a4d50

test.txt (make sure there are no leading or trailing white spaces such as space, tab etc):
Code:
Password

myrule.rule:
Code:
$4$3$1

and than run:
Code:
hashcat64.exe -m 0 -a 0 -r myrule.rule md5hash.txt test.txt

it should output:
Code:
1090d12545fd444f0a70d617d69a4d50:Password431


Messages In This Thread
RE: Custom Ruleset, Correct word but exhausted - by philsmd - 08-25-2016, 08:37 AM