hashcat for keepass using combination of the same wordslist

[domiq44]

Hello,

I am a newbie of hashcat.
But I find this activity very interesting.
Here is an exercise that I play with.

I have created a KeePass database "demo.kdbx" with a master password.
The master password is 'B0B!3-S@M!3'.

The master password match the following template XXXXSYYYY,
where XXXX and YYYY come from a given words list,
and S is a symbol.
XXXX or YYYY may be a variant of an original word by replacing some character by symbols or numbers.
Examples:
BOBIE -> B0B!3
SAMIE -> S@M!3

Symbol S can be one of "!@+-..." and other symbols.

I have created file words.txt with content:

Code:

BOBIE B0B!3 SAMIE S@M!3

And use the following command :

Code:

$ keepass2john demo.kdbx > demo.hash

Then remove at the beginning of line the word 'demo:'.

Code:

$ cat demo.hash $keepass$*2*100000*0*36c1b27ee73ab987d4f76330ae22d91b2cf8341832b118ae532faefc71fa1c5e*8cd7d38e010a3cce065bfcd69c4f3ccbb4318d58436f063fb8ee4f1a7fd323a8*758ed74daa44027c1fc29fa0039af3e0*31c6c1caf044b519c98068ad92a2711e72349783ad60301ecb3209ef1a0ec715*d587dcaf78693bf1b4669fa3d8f2029398164bdc70bdf2e8456ad74b35287d26

Code:

$ hashcat -a 1 -m 13400 -j '$-' demo.hash words.txt words.txt

But the password was not found !?

Here is the output :

Code:

hashcat (v5.1.0) starting... OpenCL Platform #1: The pocl project ==================================== * Device #1: pthread-AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx, 2048/4455 MB allocatable, 8MCU Dictionary cache built: * Filename..: words.txt * Passwords.: 5 * Bytes.....: 25 * Keyspace..: 5 * Runtime...: 0 secs Dictionary cache built: * Filename..: words.txt * Passwords.: 5 * Bytes.....: 25 * Keyspace..: 5 * Runtime...: 0 secs Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Applicable optimizers: * Zero-Byte * Single-Hash * Single-Salt Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Watchdog: Hardware monitoring interface not found on your system. Watchdog: Temperature abort trigger disabled. * Device #1: build_opts '-cl-std=CL1.2 -I OpenCL -I /usr/share/hashcat/OpenCL -D LOCAL_MEM_TYPE=2 -D VENDOR_ID=64 -D CUDA_ARCH=0 -D AMD_ROCM=0 -D VECT_SIZE=8 -D DEVICE_TYPE=2 -D DGST_R0=0 -D DGST_R1=1 -D DGST_R2=2 -D DGST_R3=3 -D DGST_ELEM=4 -D KERN_TYPE=13400 -D _unroll' Dictionary cache built: * Filename..: words.txt * Passwords.: 5 * Bytes.....: 25 * Keyspace..: 25 * Runtime...: 0 secs The wordlist or mask that you are using is too small. This means that hashcat cannot use the full parallel power of your device(s). Unless you supply more work, your cracking speed will drop. For tips on supplying more work, see: https://hashcat.net/faq/morework Approaching final keyspace - workload adjusted.  $keepass$*2*100000*0*36c1b27ee73ab987d4f76330ae22d91b2cf8341832b118ae532faefc71fa1c5e*8cd7d38e010a3cce065bfcd69c4f3ccbb4318d58436f063fb8ee4f1a7fd323a8*758ed74daa44027c1fc29fa0039af3e0*31c6c1caf044b519c98068ad92a2711e72349783ad60301ecb3209ef1a0ec715*d587dcaf78693bf1b4669fa3d8f2029398164bdc70bdf2e8456ad74b35287d26:B0B!3-S@M!3                                                 Session..........: hashcat Status...........: Cracked Hash.Type........: KeePass 1 (AES/Twofish) and KeePass 2 (AES) Hash.Target......: $keepass$*2*100000*0*36c1b27ee73ab987d4f76330ae22d9...287d26 Time.Started.....: Mon Jun 20 12:58:39 2022 (3 secs) Time.Estimated...: Mon Jun 20 12:58:42 2022 (0 secs) Guess.Base.......: File (words.txt), Left Side Guess.Mod........: File (words.txt), Right Side Speed.#1.........:        7 H/s (0.07ms) @ Accel:256 Loops:64 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts Progress.........: 20/25 (80.00%) Rejected.........: 0/20 (0.00%) Restore.Point....: 0/5 (0.00%) Restore.Sub.#1...: Salt:0 Amplifier:3-4 Iteration:99968-100000 Candidates.#1....: BOBIE-S@M!3 -> -S@M!3 Started: Mon Jun 20 12:58:33 2022 Stopped: Mon Jun 20 12:58:43 2022

When I try to see potfile, nothing

Code:

$ hashcat --show demo.hash Hashfile 'demo.hash' on line 1 ($keepa...98164bdc70bdf2e8456ad74b35287d26): Token length exception No hashes loaded.

I need some help please
Thanks.

Dominique

[Banaanhangwagen]

You need to precise the modus; try your --show command again with -m 13400

Bonus tip: make sure to use the latest Hashcat; you can find it on this website

[domiq44]

You need to precise the modus; try your --show command again with -m 13400

Bonus tip: make sure to use the latest Hashcat; you can find it on this website

Thank you ! You are right !

Code:

$ hashcat --show -m 13400 demo.hash $keepass$*2*100000*0*36c1b27ee73ab987d4f76330ae22d91b2cf8341832b118ae532faefc71fa1c5e*8cd7d38e010a3cce065bfcd69c4f3ccbb4318d58436f063fb8ee4f1a7fd323a8*758ed74daa44027c1fc29fa0039af3e0*31c6c1caf044b519c98068ad92a2711e72349783ad60301ecb3209ef1a0ec715*d587dcaf78693bf1b4669fa3d8f2029398164bdc70bdf2e8456ad74b35287d26:B0B!3-S@M!3

The password has been found !
Great !

[domiq44]

Is there any mean to put in the words list "words.txt" only original words like this :

Code:

BOBIE SAMIE

And to tell to hashcat to generate patterns like B0B!3, S@M!3 ?
Or to add condidates like them using options ?

[Banaanhangwagen]

you need to play with rules for that; see https://hashcat.net/wiki/doku.php?id=rule_based_attack

[domiq44]

you need to play with rules for that; see https://hashcat.net/wiki/doku.php?id=rule_based_attack

Words file "words.txt is now :

Code:

BOBIE SAMIE

And I have created the rule file "rules.txt"

Code:

: #Lowercase l #Uppercase u #Capitalise first character c #Substitute 'a' for '@', 'e' for '3', 'l' for '1' sa@ se3 sl1 #Substitute 'a' for '4', 'e' for '3', 'l' for '1' sa4 se3 sl1

But when I want to use it, I get :

Code:

$ hashcat -a 1 -m 13400 -j '$-' -r rules.txt demo.hash words.txt words.txt Use of -r/--rules-file and -g/--rules-generate only allowed in attack mode 0.

So, I can't use mode 0 (attack) since I work with mode 1 (combinator) !?

[Banaanhangwagen]

Correct.
There are different techniques/approaches to tackle this, for example working with princeprocessor...

[domiq44]

Correct.
There are different techniques/approaches to tackle this, for example working with princeprocessor...

Thank you for your help.
But I don't know this technique/approache

[domiq44]

I've just seen the url https://github.com/hashcat/princeprocessor
I'll take a look at this and will try to adapt my exercise.

Thank you.