WPA2 Attack from dictionary has bug?! (Solved)

[Buran]

Code:

oclHashcat-plus v0.09 by atom starting... Hashes: 1 total, 1 unique salts, 1 unique digests Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes Rules: 1 Workload: 256 loops, 80 accel Watchdog: Temperature abort trigger set to 90c Watchdog: Temperature retain trigger set to 60c Device #1: Cypress, 1024MB, 875Mhz, 20MCU ............................................................... Status.......: Running Input.Mode...: Pipe Hash.Target..: (XXXXXXXXXXXXXX) Hash.Type....: WPA/WPA2 Time.Running.: 37 mins, 40 secs Time.Util....: 2260846.2ms/77531.7ms Real/CPU, 3.6% idle Speed........: 95840 c/s Real, 99362 c/s GPU Recovered....: 0/1 Digests, 0/1 Salts Progress.....: 216678400 Rejected.....: 0 HWMon.GPU.#1.: 98% Util, 45c Temp, 27% Fan ESSID:\ufffd\ufffdI\ufffd\ufffd,;ZL Status.......: Cracked Input.Mode...: Pipe Hash.Target..: (XXXXXXXXXXXXXX) Hash.Type....: WPA/WPA2 Time.Running.: 37 mins, 43 secs Time.Util....: 2263967.6ms/77589.6ms Real/CPU, 3.5% idle Speed........: 95888 c/s Real, 98585 c/s GPU Recovered....: 1/1 Digests, 1/1 Salts Progress.....: 217088000 Rejected.....: 0 HWMon.GPU.#1.: 84% Util, 43c Temp, 24% Fan

Ubuntu 10.04.3 32-bit 4 Gb PAE
The dictionary has 7bit ASCII haracters returned by "enca"
May be anyone explain me, that the f...... ???

[epixoip]

this is an issue with your terminal encoding, not an issue with hashcat.

just because enca says the dictionary contains ascii characters doesn't mean you don't have some other characters in your dictionary as well.

use -o to capture the password to a file for further analysis.

[Buran]

...
use -o to capture the password to a file for further analysis.

Thanx for reply. I checked again with '-o' but result is the same. mcedit shows all words in dictionary is 'ok'. The dictionary has no words with broken-nonprintable symbols. Anything else to help me?

[epixoip]

hexdump -C your output file.

[epixoip]

i also notice you're running in stdin mode, not a straight dictionary attack -- what are you doing to your dictionary before piping it into hashcat?

[Buran]

i also notice you're running in stdin mode, not a straight dictionary attack -- what are you doing to your dictionary before piping it into hashcat?

I tried a lot of different commands... Results is the same. This is just an example number 9

Code:

pyrit -o - export_passwords | ./oclHashcat etc.

I was ran with command:

Code:

./oclHashcat-plus32.bin --gpu-loops 256 --gpu-temp-retain 60 -m 2500 -n 80 tplink.hccap 1.dic oclHashcat-plus v0.09 by atom starting... Hashes: 1 total, 1 unique salts, 1 unique digests Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes Rules: 1 Workload: 256 loops, 80 accel Watchdog: Temperature abort trigger set to 90c Watchdog: Temperature retain trigger set to 60c Device #1: Cypress, 1024MB, 875Mhz, 20MCU Device #1: Kernel ./kernels/4098/m2500.Cypress_923.1_1.4.1741.kernel (1819052 bytes) Scanned dictionary 1.dic: 1852746351 bytes, 167324322 words, 167324322 keyspace, starting attack... TP-LINK_8:/B� T4J�21qaz Status.......: Cracked

This password is '0987654321qaz' Have I write wrong command?

HEXdump this hash:

Code:

hexdump -C FIND1.txt 00000000 54 50 2d 4c 49 4e 4b 5f 38 3a 2f 42 93 20 54 34 |TP-LINK_8:/B. T4| 00000010 4a ae 32 31 71 61 7a 0a |J.21qaz.| 00000018

HEXdump previous (first) hash:

Code:

hexdump -C FIND.txt 00000000 68 6f 6d 65 2d 6c 61 6e 2d 74 68 65 65 3a a2 d5 |home-lan-thee:..| 00000010 49 8b ea 2c 3b 5a 4c 0a |I..,;ZL.| 00000018

[Buran]

Thank you, epixoip, for the help attempts! Problem solved. If the parameter --gpu-accel not equal 40, then HashCat-plus write password not found (-n > 40) or cracked with empty password (-n < 40). Passwords found and display it correct if only '-n 40' option presents. ATI Sapphire HD5870 OC.

[epixoip]

sounds like your problems are the result of aggressive overclocking.

[Buran]

sounds like your problems are the result of aggressive overclocking.

Yes, sounds like... But no overclock presents! RAM also in good condition. Thank you, once more!