NTLM wordlist+rules Low Utilization Still

[dhekopolis]

With the below specs, command, drivers, etc. on about 8500 NTLM hashes I get an estimated 14 days to complete. That's using the Popular Royce rule. I've been able to get it down to 3 days with the OneRuleToRuleThemAll. While this is ok, with either rule I still get the same speed and seemingly low utilization.

I'm using wordlist+rule which is the recommend "fix", but if I check the status repeatedly, sometimes I will see one or the other gpu spike up briefly, but most of the time it's low %. It will show 2-3, 14, and the occasional 45. I've seen it a few times go up to 100%, but never stays in one place for longer than an instant and most of the time is less than 5%.

I'm wondering if there is something else I should be doing or trying. I've double and tripled checked the driver on a clean XUbuntu 22.04.1 LTS install. clinfo/rocminfo checks out as does hashcat -I. 

Maybe the CPU is just too slow to feed the GPU's??

Thanks for your time! 

COMMAND - hashcat v6.2.5

Code:

hashcat -m 1000 -w 3 -O -D 2,3 -r /pantagrule/rules/private.hashorg.royce/pantagrule.popular.royce.rule -o /home/to_crack.out /home/to_crack.ntds /home/crackstation.txt

CRACKING RIG - i3-7100 w/ 2 AMD RX 480 gpus - drivers installed per the AMD instructions site 

Code:

CPU: dual core Intel Core i3-7100 (-MT MCP-) speed/min/max: 800/800/3900 MHz
Kernel: 5.15.0-58-generic x86_64 Up: 7d 38m Mem: 7459.5/15872.6 MiB (47.0%)
Storage: 238.47 GiB (11.7% used) Procs: 250 Shell: Bash inxi: 3.3.13

hashcat (v6.2.5) starting in backend information mode

OpenCL Info:
============

OpenCL Platform ID #1
  Vendor..: The pocl project
  Name....: Portable Computing Language
  Version.: OpenCL 2.0 pocl 1.8  Linux, None+Asserts, RELOC, LLVM 11.1.0, SLEEF, DISTRO, POCL_DEBUG

  Backend Device ID #1
    Type...........: CPU
    Vendor.ID......: 128
    Vendor.........: GenuineIntel
    Name...........: pthread-Intel(R) Core(TM) i3-7100 CPU @ 3.90GHz
    Version........: OpenCL 1.2 pocl HSTR: pthread-x86_64-pc-linux-gnu-skylake
    Processor(s)...: 4
    Clock..........: 3900
    Memory.Total...: 13824 MB (limited to 2048 MB allocatable in one block)
    Memory.Free....: 6880 MB
    OpenCL.Version.: OpenCL C 1.2 pocl
    Driver.Version.: 1.8

OpenCL Platform ID #2
  Vendor..: Advanced Micro Devices, Inc.
  Name....: AMD Accelerated Parallel Processing
  Version.: OpenCL 2.1 AMD-APP (3380.4)

  Backend Device ID #2
    Type...........: GPU
    Vendor.ID......: 1
    Vendor.........: Advanced Micro Devices, Inc.
    Name...........: AMD Radeon (TM) RX 480 Graphics
    Version........: OpenCL 2.0 AMD-APP (3380.4)
    Processor(s)...: 36
    Clock..........: 1291
    Memory.Total...: 4096 MB (limited to 3264 MB allocatable in one block)
    Memory.Free....: 3968 MB
    OpenCL.Version.: OpenCL C 2.0
    Driver.Version.: 3380.4 (PAL,HSAIL)
    PCI.Addr.BDF...: 07:00.0

  Backend Device ID #3
    Type...........: GPU
    Vendor.ID......: 1
    Vendor.........: Advanced Micro Devices, Inc.
    Name...........: AMD Radeon (TM) RX 480 Graphics
    Version........: OpenCL 2.0 AMD-APP (3380.4)
    Processor(s)...: 36
    Clock..........: 1291
    Memory.Total...: 4096 MB (limited to 3264 MB allocatable in one block)
    Memory.Free....: 3968 MB
    OpenCL.Version.: OpenCL C 2.0
    Driver.Version.: 3380.4 (PAL,HSAIL)
    PCI.Addr.BDF...: 01:00.0

SPEED 

Code:

Speed.#2.........:  155.8 MH/s (86.14ms) @ Accel:32 Loops:64 Thr:256 Vec:1
Speed.#3.........:  155.4 MH/s (189.94ms) @ Accel:32 Loops:64 Thr:256 Vec:1

[marc1n]

Use the latest version of hashcat v6.2.6 and yes it may be a CPU bottleneck. Recommended processor is i5 and better.

[Snoopy]

what tells

hashcat -D2 -b -m1000

what speed to expect?

[dhekopolis]

what tells

hashcat -D2 -b -m1000

what speed to expect?

Code:

hashcat (v6.2.5) starting in benchmark mode

Benchmarking uses hand-optimized kernel code by default.
You can use it in your cracking session by setting the -O option.
Note: Using optimized kernel code limits the maximum supported password length.
To disable the optimized kernel code in benchmark mode, use the -w option.

OpenCL API (OpenCL 2.0 pocl 1.8  Linux, None+Asserts, RELOC, LLVM 11.1.0, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
=====================================================================================================================================
* Device #1: pthread-Intel(R) Core(TM) i3-7100 CPU @ 3.90GHz, skipped

OpenCL API (OpenCL 2.1 AMD-APP (3380.4)) - Platform #2 [Advanced Micro Devices, Inc.]
=====================================================================================
* Device #2: AMD Radeon (TM) RX 480 Graphics, 3968/4096 MB (3264 MB allocatable), 36MCU
* Device #3: AMD Radeon (TM) RX 480 Graphics, 3968/4096 MB (3264 MB allocatable), 36MCU

Benchmark relevant options:
===========================
* --opencl-device-types=2
* --optimized-kernel-enable

-----------------------
* Hash-Mode 1000 (NTLM)
-----------------------

Speed.#2.........: 20041.1 MH/s (59.17ms) @ Accel:256 Loops:1024 Thr:128 Vec:1
Speed.#3.........: 20013.0 MH/s (59.56ms) @ Accel:256 Loops:1024 Thr:128 Vec:1
Speed.#*.........: 40054.1 MH/s

Started: Fri Feb  3 10:44:44 2023
Stopped: Fri Feb  3 10:44:54 2023

[dhekopolis]

Use the latest version of hashcat v6.2.6 and yes it may be a CPU bottleneck. Recommended processor is i5 and better.

I've tried .6 and no difference. I ran HTOP to see what the CPU was doing, and it never got above 10%... this leads me to believe the CPU isn't a bottleneck now...??