Excel Protected Workbook Known PW Length

[HelmanFrow]

p.s. I accidentally cancelled the JtR session after a fruitless 16 hours and now I'm back at square 1.

Try adding --restore to the command line and it might pick up where it left off.

Given a rate of 291/s, trying all uppercase and lowercase letters should take about 7 hours, if I'm doing the math right.
Note that hashcat will not make it super obvious when it's found; there won't be a popup or anything.
You'll be watching the 0/1 line and see when it changes to 1/1.

Ah, okay, thanks! I'll try the restore option and I'll keep an eye on the counter.

[HelmanFrow]

I tried this:

Code:

./hashcat.exe -d 2 -m9600 -a 3 --username -1 ?l?u hash.txt ?1?1?1?1

And now it appears to have hung again at Initializing backend runtime...

Yeah, it's been 25 minutes. Let's call it hung.

[HelmanFrow]

Your first attempt at cracking your password would have been fine if you didn't keep installing drivers ontop of drivers. Just use the damn OpenCL driver that would have worked at square one.

Should I uninstall the CUDA Toolkit?
I mean, I'm not using it for anything else.

[HelmanFrow]

Oh, I forgot to mention that before I read slyexe's response I applied the Driver Timeout Patch and tried again:

Code:

PS D:\desktop\hashcat-6.2.5> ./hashcat.exe -m 9600 -a 3 ?l?l?l?l hash.txt
hashcat (v6.2.5) starting

nvmlDeviceGetFanSpeed(): Not Supported

nvmlDeviceGetTemperatureThreshold(): Not Supported

CUDA API (CUDA 11.4)
====================
* Device #1: Quadro M1000M, 1685/2048 MB, 4MCU

OpenCL API (OpenCL 3.0 CUDA 11.4.156) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #2: Quadro M1000M, skipped

OpenCL API (OpenCL 3.0 ) - Platform #2 [Intel(R) Corporation]
=============================================================
* Device #3: Intel(R) HD Graphics 530, 6464/13036 MB (2047 MB allocatable), 24MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hash '?l?l?l?l': Separator unmatched
No hashes loaded.

Started: Sat Mar 19 20:43:22 2022
Stopped: Sat Mar 19 20:43:24 2022
PS D:\desktop\hashcat-6.2.5>

Just to be thorough.

[HelmanFrow]

For shits and giggles I changed the device to -d 3 (Intel GPU)

Code:

hashcat.exe -d 3 -m9600 -a 3 --username -1 ?l?u hash.txt ?1?1?1?1

It's working, but at 88 H/s which is a far cry lower than the JtR performance on CPU.

[slyexe]

For shits and giggles I changed the device to -d 3 (Intel GPU)

Code:

hashcat.exe -d 3 -m9600 -a 3 --username -1 ?l?u hash.txt ?1?1?1?1

It's working, but at 88 H/s which is a far cry lower than the JtR performance on CPU.

You're not using your CPU, you're using the integrated graphics within your CPU. Install the appropriate drivers to use your CPU. Requirements are posted right on homepage. 

https://hashcat.net/hashcat/

[HelmanFrow]

For shits and giggles I changed the device to -d 3 (Intel GPU)

Code:

hashcat.exe -d 3 -m9600 -a 3 --username -1 ?l?u hash.txt ?1?1?1?1

It's working, but at 88 H/s which is a far cry lower than the JtR performance on CPU.

You're not using your CPU, you're using the integrated graphics within your CPU. Install the appropriate drivers to use your CPU. Requirements are posted right on homepage. 

https://hashcat.net/hashcat/

Yes, I'm using the Integrated GPU, which is working at about 80 H/s.
I'm comparing that to JtR, which defaults to running on the CPU and was doing about 290 per second.

[HelmanFrow]

Either way, so far I've been unable to recruit the Quadro chip on my computer to run either JtR or HashCat.
I could really use help figuring this out.

P.S. I know this is the HashCat forum but I haven't found a similar community for JtR. If anyone knows a good JtR forum I'm all ears.

[slyexe]

So far every hashcat summary you've shown has either been the wrong syntax;

Code:

Hash '?l?l?l?l': Separator unmatched

Or has an issue loading the hash.

Code:

Hashfile 'hash.txt' on line 1 (Networ...29650db9647151a349923ea29f76d274): Signature unmatched
No hashes loaded.

So unless you've figured out the issue with the hash, your graphics card should be working just fine.  Just to be sure you can apply a workload to it to not use the optimized kernels by using -w 3.

Code:

hashcat.exe -w 3 -d 2,3 -m 9600 -a 3 --username -1 ?l?u hash.txt ?1?1?1?1

[HelmanFrow]

Okay, remember how I reported that my last attack hung while initializing the GPU? That was over six hours ago.
I actually never terminated that attempt; I minimized the PowerShell window and switched to another desktop to finish some other work. I also uninstalled the CUDA Toolkit at some point during that time.

I just switched back to that desktop to find that the attack has been RUNNING for 33 minutes.

I kid you not:

Code:

PS D:\desktop\hashcat-6.2.5> ./hashcat.exe -d 2 -m9600 -a 3 --username -1 ?l?u hash.txt ?1?1?1?1
hashcat (v6.2.5) starting

nvmlDeviceGetFanSpeed(): Not Supported

nvmlDeviceGetTemperatureThreshold(): Not Supported

CUDA API (CUDA 11.4)
====================
* Device #1: Quadro M1000M, skipped

OpenCL API (OpenCL 3.0 CUDA 11.4.156) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #2: Quadro M1000M, 1728/2048 MB (512 MB allocatable), 4MCU

OpenCL API (OpenCL 3.0 ) - Platform #2 [Intel(R) Corporation]
=============================================================
* Device #3: Intel(R) HD Graphics 530, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD-LOOP
* Uses-64-Bit

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 111 MB

Cracking performance lower than expected?

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.
Driver temperature threshold met on GPU #2. Expect reduced performance.

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Mode........: 9600 (MS Office 2013)
Hash.Target......: $office$*2013*100000*256*16*be504576f33edb6cb25d640...76d274
Time.Started.....: Sun Mar 20 21:21:34 2022 (33 mins, 39 secs)
Time.Estimated...: Sun Mar 20 23:24:14 2022 (1 hour, 29 mins)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?1?1?1?1 [4]
Guess.Charset....: -1 ?l?u, -2 Undefined, -3 Undefined, -4 Undefined
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........:      995 H/s (10.15ms) @ Accel:128 Loops:64 Thr:128 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 1998848/7311616 (27.34%)
Rejected.........: 0/1998848 (0.00%)
Restore.Point....: 32768/140608 (23.30%)
Restore.Sub.#2...: Salt:0 Amplifier:18-19 Iteration:52992-53056
Candidate.Engine.: Device Generator
Candidates.#2....: wnny -> wypb
Hardware.Mon.#2..: Temp: 74c Util: 98% Core:1097MHz Mem:2505MHz Bus:16

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>

I had to do a double-take but there it is! Did it actually take five-and-a-half hours to initialize the runtime or did something kick in when I uninstalled the CUDA Toolkit?

The funny thing is that I was just about to install a previous version of CUDA Toolkit which includes PTX 7.4 because the current version (which includes PTX 7.6) doesn't seem to be supported by HashCat in its current release.