I hit what looks like a Hashcat/ ssh2john format mismatch in the SSH key passphrase l
#1
Exclamation 
I hit what looks like a Hashcat/
ssh2john
format mismatch in the SSH key passphrase lab.
id_rsa
is valid now —
ssh-keygen -y -f id_rsa
prompts for the passphrase.
I extracted with:

ssh2john id_rsa > ssh.hash

ssh.hash
is one clean line starting with:

id_rsa:$sshng$6$16$...

But Hashcat
v7.1.2
rejects it:

hashcat -m 22921 ssh.hash ssh.passwords -r ssh.rule

Error:

Token length exception
No hashes loaded

And:

hashcat --identify ssh.hash

returns:

No hash-mode matches the structure of the input hash.

Has anyone seen this with newer OpenSSH
$sshng$6$16$...
hashes? Is mode
22921
currently incompatible with
ssh2john
output here, or is there a different extractor/workflow I should be using?
Reply
#2
you must remove the text "id_rsa:" from the line.
Reply