weird mask attack

[inoo]

Hello, I found weird thing when I executed oclHashcat-1.01 with -m 300

for example:
./oclHashcat64.exe -a 3 -m 300 --remove --status \
./mysql_hash.txt -o ../mysql_hash_result.txt \
./masks/rockyou-1-60.hcmask


----------OUTPUT------------
Session.Name...: oclHashcat
Status.........: Running
Input.Mode.....: Mask (?1) [1]
Hash.Target....: File (../hash/mysql/mysql_hash.txt)
Hash.Type......: MySQL
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...: 0 H/s
Recovered......: 0/2 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 0/62 (0.00%)
Rejected.......: 0/0 (0.00%)
HWMon.GPU.#1...: 24% Util, 5c Temp, N/A Fan

Session.Name...: oclHashcat
Status.........: Running
Input.Mode.....: Mask (?1?2) [2]
Hash.Target....: File (../hash/mysql/mysql_hash.txt)
Hash.Type......: MySQL
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...: 0 H/s
Recovered......: 0/2 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 0/2232 (0.00%)
Rejected.......: 0/0 (0.00%)
HWMon.GPU.#1...: 30% Util, 5c Temp, N/A Fan
...
...

in rockyou-1-60.hcmask file, there is no pre-defined CS [1],[2],[3],[4]
but oclHashcat was running normally with [1][2][3][4] type masks

Is it normal thing?
I don't know whether hashcat bug or not?

[philsmd]

There is something strange in your output, for instance it says it uses the hashes located at ../hash/mysql/mysql_hash.txt but your command line says it should use the file mysql_hash.txt in the current directory
The problem is, since you changed the output and/or the command we can't be sure what the problem is.

why don't you try a very basic command like:

Code:

./oclHashcat64.exe -m 0 example0.hash -a 3 masks\rockyou-1-60.hcmask

Note: 1 problem could be that rockyou-1-60.hcmask is not in the directory you have specified (i.e. test it with "type masks\rockyou-1-60.hcmask")....
Furthermore, on a test windows machine all paths expand w/ "\" (but dunno if this is the problem), also note: if you run just ./oclHashcat64.exe -m 0 example0.hash -a 3 the output - sequence of masks - you just posted is to be expected (since this is the default behaviour, i.e. increment enabled + default mask + charsets)
And I am also not sure if those lines breaks + "\" influence the behaviour (it could be if you forget to add spaces etc before the "\" newline break)

[inoo]

Thank you for answer.
I am sorry about missing oclHashcat64.exe in win7/cygwin/bash environment.
so, cmd line is the same as Linux/bash env , though my env is win7,
for example : use \(linux/unix) instead ^(dos), /(linux path seperater) instead \(dos path sep)

the cmd line is original except hash file and output file paths as you comment out
I try your recommended cmd, Linux/oclHashcat64.bin -m 3 commnd is normal as I expected

Many thanks;

[inoo]

I upload the log file..

[philsmd]

These lines:

Code:

$HASHCAT -a 3  -m 300 --remove --status --gpu-temp-retain=95 \
  ../hash/mysql/mysql_hash.txt  -o ../hash/mysql/mysql_hash_result.txt
  ../oclHashcat-1.01/masks/rockyou-1-64.hcmask

make oclHashcat run without any (user-specified) mask (nor hcmask, => default mask + increment) .... since there is no "\" after the output file "../hash/mysql/mysql_hash_result.txt" oclHashcat will start without getting the information that you also specified a hcmask...

This is because you didn't add the (second) "\" (== skip newline) and the next line:

Code:

../oclHashcat-1.01/masks/rockyou-1-64.hcmask

will be interpreted as a new command