Can hybrid attack work with rules?

[SopalajoArrierez]

OCLHashCat v1.32 yields no error for this command-line (hybrid attack):

Code:

oclhashcat64 -m 1000 Hashes.txt -a 6 Dictio.txt ?d -j d

So, can I assume that "-j" option (rule for left dictionary) works with this attack?

Thanks you.

[atom]

Single rules (-j) are supposed to work in this case, just -r is not.

[SopalajoArrierez]

Well... then, I think I have found a bug in OCLHashCat.
Case command-line:

Code:

# Creation of the password test file with key example "rafa3rafa3:
temp=$(iconv -f ASCII -t UTF-16LE <(printf "rafa3rafa3") | openssl dgst -md4)
temp=$(echo $temp | awk 'NF>1{print $NF}')
temp="Administrador:500:aad3b435b51404eeaad3b435b51404ee:"$temp":::"
echo $temp > TestPassword.txt

oclhashcat64 -m 1000 TestPassword.txt -a 6 "c:\Dictionaries\cain.txt" ?d -j d

oclHashcat v1.32 starting...

Device #1: Bonaire, 1024MB, 1050Mhz, 12MCU
Device #2: Tahiti, 3072MB, 1000Mhz, 32MCU
Device #3: Tahiti, 3072MB, 900Mhz, 28MCU

Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes
Applicable Optimizers:
* Zero-Byte
* Precompute-Init
* Precompute-Merkle-Demgard
* Meet-In-The-Middle
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Scalar-Mode
* Raw-Hash
Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger set to 80c
Device #1: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/m01000_a1.Bonaire
_1573.4_1573.4 (VM).kernel (190372 bytes)
Device #1: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/markov_le_v2.Bona
ire_1573.4_1573.4 (VM).kernel (39912 bytes)
Device #2: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/m01000_a1.Tahiti_
1573.4_1573.4 (VM).kernel (190384 bytes)
Device #2: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/markov_le_v2.Tahi
ti_1573.4_1573.4 (VM).kernel (39952 bytes)
Device #3: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/m01000_a1.Tahiti_
1573.4_1573.4 (VM).kernel (190384 bytes)
Device #3: Kernel d:\Programas\HashCat\OCLHashCat/kernels/4098/markov_le_v2.Tahi
ti_1573.4_1573.4 (VM).kernel (39952 bytes)

Generating dictionary stats for j:\Repositorio de Diccionarios para Ataques\Dicc
ionarios Base\Precompilados\cain.txt: 3149586 bytes (100.00%), 306706 words, 306


Generated dictionary stats for j:\Repositorio de Diccionarios para Ataques\Dicci
onarios Base\Precompilados\cain.txt: 3149586 bytes, 306706 words, 3067060 keyspa
ce


INFO: approaching final keyspace, workload adjusted


Session.Name...: oclHashcat
Status.........: Exhausted
Input.Left.....: File (j:\Repositorio de Diccionarios para Ataques\Diccionarios
Base\Precompilados\cain.txt)
Input.Right....: Mask (?d) [1]
Hash.Target....: 58a4b878e3ba2e06093acfae1d872391
Hash.Type......: NTLM
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...:   225.2 MH/s
Speed.GPU.#2...:   593.2 MH/s
Speed.GPU.#3...:   466.1 MH/s
Speed.GPU.#*...:  1284.5 MH/s
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 3067060/3067060 (100.00%)
Skipped........: 0/3067060 (0.00%)
Rejected.......: 35570/3067060 (1.16%)
HWMon.GPU.#1...:  0% Util, 35c Temp, 22% Fan
HWMon.GPU.#2...:  3% Util, 39c Temp, 21% Fan
HWMon.GPU.#3...: 35% Util, 38c Temp, 30% Fan

WARNING: Failed to restore default fan speed for gpu number: 2:
Started: Sat Jan 24 04:53:54 2015
Stopped: Sat Jan 24 04:53:56 2015

I think the rule is being ignored.
Same results for "-k" intead of "-j".
Should I open a bug ticket?

Note: Cain dictionary downloaded from here:
http://downloads.skullsecurity.org/passw...in.txt.bz2

[epixoip]

I don't think that attack does what you think it does. Your plaintext input is "rafa3rafa3". If cain.txt contains the word "rafa", then "-a 6 cain.txt ?d -j d" will generate the candidate "rafarafa3" but not "rafa3rafa3".

[SopalajoArrierez]

If cain.txt contains the word "rafa", then "-a 6 cain.txt ?d -j d" will generate the candidate "rafarafa3" but not "rafa3rafa3".

I understand: rules are applied before, and idctionary combination is applied later. Thanks you.
Then the only way to generate "rafa3rafa3" would be the previous generation of a dictionary "cain.txt" combined with "?d" (1 decimal digit), so it will contain the word "rafa3" and do:

Code:

oclhashcat64 -m 1000 TestPassword.txt cain-mask-1xd.txt -j d

Or there is a better way without needing to create a new dictionary?

[philsmd]

to avoid to generate a large dict also something like this would work in your particular case:
file: my_append_num_and_duplicate.rule

Code:

$0 d
$1 d
$2 d
$3 d
$4 d
$5 d
$6 d
$7 d
$8 d
$9 d

Code:

oclhashcat64 -m 1000 -r my_append_num_and_duplicate.rule TestPassword.txt cain.txt

[SopalajoArrierez]

to avoid to generate a large dict also something like this would work in your particular case:

Code:

oclhashcat64 -m 1000 -r my_append_num_and_duplicate.rule TestPassword.txt cain.txt

A good idea, indeed.
Would it be the same as this other one?

Code:

oclhashcat64 -m 1000 -r my_append_num.rule TestPassword.txt cain.txt -j d

Considering the file is now:

Code:

$0
$1
$2
$3
$4
$5
$6
$7
$8
$9

[SopalajoArrierez]

Mmm.. I think I could answer myself. Acording to my tests, it seems that the order between -r, -j and -k would be:
-j goes first.
-r goes second.
-k doesn't go: it is ignored.
Am I right?

[philsmd]

-k is applied only on the second dictionary. So it makes sense for instance with "-a 1 dict1.txt dict2.txt".

So technically it isn't ignored, it just not applied since there is no second dictionary (or better said, the right-hand side) in your particular case.

Btw. I am not quite sure why you insist to use -j d . If you want to "split" the rules, there is also another interesting feature called multi-rules: see https://hashcat.net/wiki/doku.php?id=rul...ulti-rules .
Basically, you can do -r append_num.rule -r duplicate.rule

[SopalajoArrierez]

If you want to "split" the rules, there is also another interesting feature called multi-rules: see https://hashcat.net/wiki/doku.php?id=rul...ulti-rules .
Basically, you can do -r append_num.rule -r duplicate.rule

Fine! That is the one I was searching for.
When reading the docs, I thought multirules where sequential (attack the hash by using append_num.rule, then attack the hash by using duplicate.rul, not combined).
It makes more sense now.
Thanks you all for explaining.