Same hashes different results

[Jogjab]

Hi, I'm looking into MSSQL 2005 hashes.

I've run hashcat on my workstation cpu previously and everything seemed to work fine. Today I started with Hashcat-plus (cudaHashcat-plus64 0.14.7z to be precise) running on an Amazon EC2 Cluster GPU instance.

I've been using 2 hashes for testing purposes that both result in a 5 character result. The weird thing is that every other time (literally 2 out of 4 runs) I run the command the result changes between Exhausted and Cracked.

Same hashes, same command:
-a 3 -m 132 -1 ?l?u?d <hashfile> ?1?1?1?1?1

The results are both lower case alpha characters only. And although the success rate seems to be somewhat higher when I run with just ?l instead of ?l?u?d it still returns exhausted 1 out of 5 times.

What could this possibly be? What could I try to fix this?

[atom]

You could start posting all required information for us to reproduce the problem. Like hashes, dictionary, words, commandlines, screenshots, etc..

[Jogjab]

That was going to be my next step. I thought someone might recognize this issue from my description alone. Especially since it's a simple 5 character brute force, no words, no dictionaries.

The command line I posted already:
-a 3 -m 132 -1 ?l <hashfile> ?1?1?1?1?1
and
-a 3 -m 132 -1 ?l?u?d <hashfile> ?1?1?1?1?1

I will add screenshots and hashes later today

[philsmd]

Did some test now but was unable to reproduce this. Are you sure that the charset matches with the passwords, i.e. that all hashes *could* definitely be cracked by the mask? E.g are there no special characters etc.

Please also tell us what hardware do you use (cuda/ocl - card model) and/or which kernel is loaded.

MY TESTS:

Code:

// Description: Generates the MSSQL 2005 hashes starting from a password and salt // Date: 05/22/13 // // License: belongs to the PUBLIC DOMAIN, donated to hashcat, credits MUST go to hashcat // and me for their hard work. Thx // Disclaimer: WE PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER // EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES // OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // Furthermore, NO GUARANTEES THAT IT WORKS FOR YOU AND WORKS CORRECTLY // // HOWTO compile: gcc mssql_2005_compute.c -o mssql_2005_compute -lcrypto // Example usage: ./mssql_2005_compute hashcat 18102152 // 0x010018102152f8f28c8499d8ef263c53f8be369d799f931b2fbe #include <string.h> #include <stdio.h> #include <openssl/sha.h> #define DIGEST_LENGTH 20 #define MSSQL2005_IDENTIFIER "0100" #define MAX_PASS_LEN 50 #define MAX_LEN_SALT 8 // 8 octets == 4 hex #define MAX_LEN_UNICODE_SALT 105 #define HEX_BLOCK_SIZE 2 char*HEX_CHARS="0123456789abcdef"; int generate_hash(char digest[DIGEST_LENGTH],char*salt,char*pass) { int i,len_pass,len_unicode_salt; char unicode_salt[MAX_LEN_UNICODE_SALT]; len_pass=strlen(pass); if (len_pass>MAX_PASS_LEN) { printf("[-] ERROR: password too long. EXIT.\n"); return 0; } // Convert pass to uppercase unicode memset(unicode_salt,0,MAX_LEN_UNICODE_SALT); len_unicode_salt=len_pass*2; for (i=0; i<len_pass; i++) { unicode_salt[i*2]=pass[i]; // Unicode } // Salt memcpy(unicode_salt+len_unicode_salt,salt,4); len_unicode_salt+=4; SHA_CTX context; SHA1_Init(&context); SHA1_Update(&context,(unsigned char*)unicode_salt,len_unicode_salt); SHA1_Final(digest, &context); return 0; } void print_hash(unsigned char*salt,unsigned char digest[DIGEST_LENGTH]) { int i; printf("0x%s",MSSQL2005_IDENTIFIER); for (i=0; i<sizeof(salt)/sizeof(char); i++) { printf("%02x",salt[i]); } for (i=0; i<DIGEST_LENGTH; i++) { printf("%02x",digest[i]); } printf("\n"); } int parse_salt(char salt[MAX_LEN_SALT],char*input) { int i,j,len_hex=strlen(HEX_CHARS),power,len=strlen(input); char*pos; if (len<MAX_LEN_SALT) { fprintf(stderr,"[-] Error: salt is too short, length of %i expected\n", MAX_LEN_SALT); return 1; } if (len!=MAX_LEN_SALT) { fprintf(stderr,"[!] Warning: salt should be *exactly* of length %i, ", MAX_LEN_SALT); fprintf(stderr,"using only first %i bytes\n",MAX_LEN_SALT); } memset(salt,0,MAX_LEN_SALT+1); // null terminator included for (i=0; i<MAX_LEN_SALT; i+=HEX_BLOCK_SIZE) { for (j=0,power=len_hex; j<HEX_BLOCK_SIZE; j++,power/=len_hex) { pos=strchr(HEX_CHARS,input[i+j]); if (pos==NULL) { fprintf(stderr,"[-] Unexpected character encountered. *Not* a valid"); fprintf(stderr," hex char. EXIT\n"); return 1; } salt[i/HEX_BLOCK_SIZE]+=(pos-HEX_CHARS)*power; } } return 0; } void usage() { printf("--- MSSQL 2005 COMPUTE ---\nUSAGE:\n ./mssql_2005_compute "); printf("<PASS> <HEX_SALT>\n"); } int main(int argc,char**argv) { int i; unsigned char digest[DIGEST_LENGTH]; // COMMAND LINE PARSING if (argc<2) { fprintf(stderr,"[-] Please specify the password. EXIT\n"); usage(); return 1; } if (argc<3) { fprintf(stderr,"[-] Please specify a salt. EXIT\n"); usage(); return 1; } // END COMMAND LINE PARSING char salt[MAX_LEN_SALT+1]; if (!parse_salt(salt,argv[2])) { if (!generate_hash(digest,salt,argv[1])) { // success print_hash(salt,digest); return 0; } else { fprintf(stderr,"[-] Error: password generation was *not* successful"); return 1; } } return 1; }

My salt from example (http://hashcat.net/wiki/doku.php?id=example_hashes ): 18102152

My test file: hash_mssql2005
5 lower case letters as per example above

Code:

$ ./mssql_2005_compute testa 18102152 > hash_mssql2005 $ ./mssql_2005_compute testb 18102152 >> hash_mssql2005 $ ./mssql_2005_compute testc 18102152 >> hash_mssql2005 $ ./mssql_2005_compute hashc 18102152 >> hash_mssql2005

My command line:

Code:

$ cudaHashcat-plus32 -a 3 -m 132 -1 ?l?u?d hash_mssql2005 ?1?1?1?1?1

AND

Code:

$ cudaHashcat-plus32 -a 3 -m 132 -1 ?l hash_mssql2005 ?1?1?1?1?1

The result of my tests are that I always get all hashes cracked and "Status.........: Cracked" in the output (as expected).
Could you try to do the same?

[Jogjab]

I just tested with the following hashes:

0x0100493B0CD58C4FC9AE7EE99DE6E1A7FB7CF3A5C06F772EE6C3
0x0100493B0CD5E0D54FEA458255877489497C7CAD4B194CBA78E0
0x0100439E6485166D20C4F889C2D5E7586776EC1E9C587708DC7F
0x010092F57A756207EC7C5DBA4B049B2B8F48F78BE393C8574961
0x01004315BFDDA7111F6527DBB1231B959965F2240CB8B458CC8F
0x010005023796D13D79705008012D8B79E145240F36208AA43F31
0x0100D9DDCA46A82CFF7F01DC9AC622BE4A9336DE592F6554CB2A
0x0100A5AD3B3D4C8A4EBFEB47B4158F5B7AB532521E947AC2E290
0x0100493B0CD5C6E788CE01102D5ECEB000428558CD76CAA202DC

these should result in the following (not in order):
testa
atset
xlasi
ylupr
xiazl
brlec
weird
testab
qrtwey

For some reason I haven't been able to get 'testa'. Even after 10 runs, it just never returns this.
I have unexpected behavior with some of the others as well. But 'testa' just never works.

My command lines are
sudo ./cudaHashcat-plus64.bin -a 3 -m 132 -1 ?l -i --increment-min=5 --increment-max=6 hashes.test ?1?1?1?1?1?1
and
sudo ./cudaHashcat-plus64.bin -a 3 -m 132 -1 ?l?u?d -i --increment-min=5 --increment-max=6 hashes.test ?1?1?1?1?1?1

As for the hardware: I'm testing Amazon EC2 GPU Cluster

Take a look at these weird results. Same test set run with a couple of seconds between them. Only difference is ?l?u?d vs ?l
But the results aren't the same. And even in the second case it still doesn't return 'testa'

Code:

sudo ./cudaHashcat-plus64.bin -a 3 -m 132 -1 ?l?u?d -i --increment-min=5 --increment-max=6 hashes.test ?1?1?1?1?1?1 cudaHashcat-plus v0.14 by atom starting... Hashes: 11 total, 7 unique salts, 10 unique digests Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes Workload: 128 loops, 80 accel Watchdog: Temperature abort trigger set to 90c Watchdog: Temperature retain trigger set to 80c Device #1: Tesla M2050, 2687MB, 1147Mhz, 14MCU Device #2: Tesla M2050, 2687MB, 1147Mhz, 14MCU Device #1: Kernel ./kernels/4318/m0130_a3.sm_20.64.ptx Device #2: Kernel ./kernels/4318/m0130_a3.sm_20.64.ptx 0x01004315bfdda7111f6527dbb1231b959965f2240cb8b458cc8f:xlasi 0x010092f57a756207ec7c5dba4b049b2b8f48f78be393c8574961:atset 0x010005023796d13d79705008012d8b79e145240f36208aa43f31:ylupr 0x0100a5ad3b3d4c8a4ebfeb47b4158f5b7ab532521e947ac2e290:brlec 0x0100d9ddca46a82cff7f01dc9ac622be4a9336de592f6554cb2a:xiazl 0x0100493b0cd58c4fc9ae7ee99de6e1a7fb7cf3a5c06f772ee6c3:weird 0x0100439e6485166d20c4f889c2d5e7586776ec1e9c587708dc7f:testb Session.Name...: cudaHashcat-plus Status.........: Exhausted Input.Mode.....: Mask (?1?1?1?1?1?1) Hash.Target....: File (hashes.test) Hash.Type......: MSSQL(2005) Time.Started...: Thu May 23 20:24:03 2013 (1 min, 13 secs) Time.Estimated.: 0 secs Speed.GPU.#1...: 390.2M/s Speed.GPU.#2...: 390.2M/s Speed.GPU.#*...: 780.4M/s Recovered......: 7/10 (70.00%) Digests, 6/7 (85.71%) Salts Progress.......: 397601649088/397601649088 (100.00%) Rejected.......: 340801413504/397601649088 (85.71%) HWMon.GPU.#1...: 27% Util, -1c Temp, -1% Fan HWMon.GPU.#2...: 40% Util, -1c Temp, -1% Fan Started: Thu May 23 20:24:03 2013 Stopped: Thu May 23 20:25:26 2013 sudo ./cudaHashcat-plus64.bin -a 3 -m 132 -1 ?l -i --increment-min=5 --increment-max=6 hashes.test ?1?1?1?1?1?1 cudaHashcat-plus v0.14 by atom starting... Hashes: 11 total, 7 unique salts, 10 unique digests Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes Workload: 128 loops, 80 accel Watchdog: Temperature abort trigger set to 90c Watchdog: Temperature retain trigger set to 80c Device #1: Tesla M2050, 2687MB, 1147Mhz, 14MCU Device #2: Tesla M2050, 2687MB, 1147Mhz, 14MCU Device #1: Kernel ./kernels/4318/m0130_a3.sm_20.64.ptx Device #2: Kernel ./kernels/4318/m0130_a3.sm_20.64.ptx 0x01004315bfdda7111f6527dbb1231b959965f2240cb8b458cc8f:xlasi 0x010092f57a756207ec7c5dba4b049b2b8f48f78be393c8574961:atset 0x0100a5ad3b3d4c8a4ebfeb47b4158f5b7ab532521e947ac2e290:brlec 0x0100d9ddca46a82cff7f01dc9ac622be4a9336de592f6554cb2a:xiazl 0x010005023796d13d79705008012d8b79e145240f36208aa43f31:ylupr 0x0100493b0cd58c4fc9ae7ee99de6e1a7fb7cf3a5c06f772ee6c3:weird 0x0100439e6485166d20c4f889c2d5e7586776ec1e9c587708dc7f:testb 0x0100493b0cd5c6e788ce01102d5eceb000428558cd76caa202dc:qrtwey 0x0100493b0cd5adeda1e3a7caf1b8784fcd766e54c2cc787426af:testab Session.Name...: cudaHashcat-plus Status.........: Exhausted Input.Mode.....: Mask (?1?1?1?1?1?1) Hash.Target....: File (hashes.test) Hash.Type......: MSSQL(2005) Time.Started...: Thu May 23 20:25:48 2013 (1 sec) Time.Estimated.: 0 secs Speed.GPU.#1...: 254.9M/s Speed.GPU.#2...: 261.2M/s Speed.GPU.#*...: 516.0M/s Recovered......: 9/10 (90.00%) Digests, 6/7 (85.71%) Salts Progress.......: 2162410432/2162410432 (100.00%) Rejected.......: 1853494656/2162410432 (85.71%) HWMon.GPU.#1...: 0% Util, -1c Temp, -1% Fan HWMon.GPU.#2...: 6% Util, -1c Temp, -1% Fan Started: Thu May 23 20:25:48 2013 Stopped: Thu May 23 20:25:56 2013

So, I just don't understand the difference between the two and I don't understand why it doesn't return 'testa'

[Jogjab]

As for your other questions...

I started using Linux yesterday. So I hope I'm anwsering you're questions correctly:
I'm running:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=11.10
DISTRIB_CODENAME=oneiric
DISTRIB_DESCRIPTION="Ubuntu 11.10"

And it's cuda

Did some test now but was unable to reproduce this. Are you sure that the charset matches with the passwords, i.e. that all hashes *could* definitely be cracked by the mask? E.g are there no special characters etc.

Please also tell us what hardware do you use (cuda/ocl - card model) and/or which kernel is loaded.

MY TESTS:

Code:

// Description: Generates the MSSQL 2005 hashes starting from a password and salt // Date: 05/22/13 // // License: belongs to the PUBLIC DOMAIN, donated to hashcat, credits MUST go to hashcat // and me for their hard work. Thx // Disclaimer: WE PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER // EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES // OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // Furthermore, NO GUARANTEES THAT IT WORKS FOR YOU AND WORKS CORRECTLY // // HOWTO compile: gcc mssql_2005_compute.c -o mssql_2005_compute -lcrypto // Example usage: ./mssql_2005_compute hashcat 18102152 // 0x010018102152f8f28c8499d8ef263c53f8be369d799f931b2fbe #include <string.h> #include <stdio.h> #include <openssl/sha.h> #define DIGEST_LENGTH 20 #define MSSQL2005_IDENTIFIER "0100" #define MAX_PASS_LEN 50 #define MAX_LEN_SALT 8 // 8 octets == 4 hex #define MAX_LEN_UNICODE_SALT 105 #define HEX_BLOCK_SIZE 2 char*HEX_CHARS="0123456789abcdef"; int generate_hash(char digest[DIGEST_LENGTH],char*salt,char*pass) { int i,len_pass,len_unicode_salt; char unicode_salt[MAX_LEN_UNICODE_SALT]; len_pass=strlen(pass); if (len_pass>MAX_PASS_LEN) { printf("[-] ERROR: password too long. EXIT.\n"); return 0; } // Convert pass to uppercase unicode memset(unicode_salt,0,MAX_LEN_UNICODE_SALT); len_unicode_salt=len_pass*2; for (i=0; i<len_pass; i++) { unicode_salt[i*2]=pass[i]; // Unicode } // Salt memcpy(unicode_salt+len_unicode_salt,salt,4); len_unicode_salt+=4; SHA_CTX context; SHA1_Init(&context); SHA1_Update(&context,(unsigned char*)unicode_salt,len_unicode_salt); SHA1_Final(digest, &context); return 0; } void print_hash(char*salt,unsigned char digest[DIGEST_LENGTH]) { int i; printf("0x%s",MSSQL2005_IDENTIFIER); for (i=0; i<sizeof(salt)/sizeof(char); i++) { printf("%02x",salt[i]); } for (i=0; i<DIGEST_LENGTH; i++) { printf("%02x",digest[i]); } printf("\n"); } int parse_salt(char salt[MAX_LEN_SALT],char*input) { int i,j,len_hex=strlen(HEX_CHARS),power,len=strlen(input); char*pos; if (len<MAX_LEN_SALT) { fprintf(stderr,"[-] Error: salt is too short, length of %i expected\n", MAX_LEN_SALT); return 1; } if (len!=MAX_LEN_SALT) { fprintf(stderr,"[!] Warning: salt should be *exactly* of length %i, ", MAX_LEN_SALT); fprintf(stderr,"using only first %i bytes\n",MAX_LEN_SALT); } memset(salt,0,MAX_LEN_SALT+1); // null terminator included for (i=0; i<MAX_LEN_SALT; i+=HEX_BLOCK_SIZE) { for (j=0,power=len_hex; j<HEX_BLOCK_SIZE; j++,power/=len_hex) { pos=strchr(HEX_CHARS,input[i+j]); if (pos==NULL) { fprintf(stderr,"[-] Unexpected character encountered. *Not* a valid"); fprintf(stderr," hex char. EXIT\n"); return 1; } salt[i/HEX_BLOCK_SIZE]+=(pos-HEX_CHARS)*power; } } return 0; } void usage() { printf("--- MSSQL 2005 COMPUTE ---\nUSAGE:\n ./mssql_2005_compute "); printf("<PASS> <HEX_SALT>\n"); } int main(int argc,char**argv) { int i; unsigned char digest[DIGEST_LENGTH]; // COMMAND LINE PARSING if (argc<2) { fprintf(stderr,"[-] Please specify the password. EXIT\n"); usage(); return 1; } if (argc<3) { fprintf(stderr,"[-] Please specify a salt. EXIT\n"); usage(); return 1; } // END COMMAND LINE PARSING char salt[MAX_LEN_SALT+1]; if (!parse_salt(salt,argv[2])) { if (!generate_hash(digest,salt,argv[1])) { // success print_hash(salt,digest); return 0; } else { fprintf(stderr,"[-] Error: password generation was *not* successful"); return 1; } } return 1; }

My salt from example (http://hashcat.net/wiki/doku.php?id=example_hashes ): 18102152

My test file: hash_mssql2005
5 lower case letters as per example above

Code:

$ ./mssql_2005_compute testa 18102152 > hash_mssql2005 $ ./mssql_2005_compute testb 18102152 >> hash_mssql2005 $ ./mssql_2005_compute testc 18102152 >> hash_mssql2005 $ ./mssql_2005_compute hashc 18102152 >> hash_mssql2005

My command line:

Code:

$ cudaHashcat-plus32 -a 3 -m 132 -1 ?l?u?d hash_mssql2005 ?1?1?1?1?1

AND

Code:

$ cudaHashcat-plus32 -a 3 -m 132 -1 ?l hash_mssql2005 ?1?1?1?1?1

The result of my tests are that I always get all hashes cracked and "Status.........: Cracked" in the output (as expected).
Could you try to do the same?

[philsmd]

I did now try to run the exactly same cmds on my machine (32bit, cuda - gtx 580, win) and I always get following output (tested w/ newest beta and w/ release version 0.14):

Code:

Recovered......: 10/10 (100.00%) Digests, 7/7 (100.00%) Salts

Maybe you are able to test w/ another setup (machine, 32 bit on same machine etc).
It definitely works here (also running it repeatedly).

Update: now tested also on a Cuda/64 bit Ubuntu system (this setup should be indeed similar to yours!?), both cmds working perfectly there recovering 10 Digest, 7 Salts... Could you try on windows or on 32 bit linux please (and also try oclHashcat-plus32.bin on your 64 bit system)?
Thx