Combine to user:pass, Crashes with --show

[eddow]

Hi,

I have some issues combining two files. I have a 250k IPB hash file (yes this one is posted here before, and no I don't need it cracked further)

My 250k file is formatted: User:Hash:Salt
my 100k file is formatted : Hash:Saltassword

I need to get user:pass

I have tried doing this with hashcat:

hashcat-cli64.exe -m 2811 --username --show --outfile-format=2 -o Output.txt Hashes.txt

But it crashes with OCL version, and with CPU version I only get plain passwords, no usernames.

Thank you for helping!!

PS filesize to big for attachment, can be downloaded here:

https://ugaris.com/zipme.zip

[philsmd]

Thanks for the report.

Next time please consider opening a trac ticket if you experience a problem/crash and can reliable reproduce it.
Thx

BTW: the problem was anyways trac'ed here: https://hashcat.net/trac/ticket/565

[eddow]

Thanks for the report.

Next time please consider opening a trac ticket if you experience a problem/crash and can reliable reproduce it.
Thx

BTW: the problem was anyways trac'ed here: https://hashcat.net/trac/ticket/565

Sorry, will do next time. However, here is another funny thing about it. Using CPUHashcat (calling it like that for now), I am able to produce a full list with user:hashalt:pass without any issues.

Here would be that result:

https://ugaris.com/cpucat.zip

What would be my best route of action to get it to user:pass? (Without waiting on the fix of-course)

EDIT: Is the beta somewhere available for download?

[philsmd]

I think you mean this problem, or better said "feature request" in cpu hashcat:
https://hashcat.net/forum/thread-3992-po...l#pid22809

Afaik nobody bothered to open a ticket about this "missing feature". It is much more likely that it will be implemented when somebody adds it on trac.

So it is currently not possible to use --show --username with cpu hashcat, because not supported.

If you don't want to wait, you should probably just fix the input hash list(s), i.e. make the "user names" valid user names (non-empty) and (maybe also) without the strange colon prefixes etc. This will work also with current release version

[eddow]

I think you mean this problem, or better said "feature request" in cpu hashcat:
https://hashcat.net/forum/thread-3992-po...l#pid22809

Afaik nobody bothered to open a ticket about this "missing feature". It is much more likely that it will be implemented when somebody adds it on trac.

So it is currently not possible to use --show --username with cpu hashcat, because not supported.

If you don't want to wait, you should probably just fix the input hash list(s), i.e. make the "user names" valid user names (non-empty) and (maybe also) without the strange colon prefixes etc. This will work also with current release version

The current input hash list is 250k characters long, no way it could be "fixed" manually, any input on how to fix it without spending a life-time?

[philsmd]

wait.
this task won't take you longer than some ms (case #1) or seconds (case #2).

#1: you just sed / awk etc it
#2: you open a reliable text editor (like vi / vim, maybe also notepad++ etc) and search and replace the beginnings of the lines with valid data

This is very easy and basic file manipulation every computer users should be able to do (with help of reliable tools like sed/awk/vim/notepad++ etc)... And anyway the files are considerable small (not even hundreds or thousands of mega bytes, MB).

[eddow]

wait.
this task won't take you longer than some ms (case #1) or seconds (case #2).

#1: you just sed / awk etc it
#2: you open a reliable text editor (like vi / vim, maybe also notepad++ etc) and search and replace the beginnings of the lines with valid data

This is very easy and basic file manipulation every computer users should be able to do (with help of reliable tools like sed/awk/vim/notepad++ etc)... And anyway the files are considerable small (not even hundreds or thousands of mega bytes, MB).

That is, if you know the exact problem that is causing it? I removed all empty, and all usernames with ":::"'s in it, still crashing, or simply not outputting more then 3k entries

[philsmd]

As said, here and in the trac ticket, the first field (the username) can never be empty in the current release version.
That means, that a line starting with a colon.
:HASH:SALT

is currently not valid (and may end in a crash).

Next version will also accept the empty user name field.

Therefore, a possible solution is:
replace all lines starting with the colon symbol ":" with something like "USERNAME_MISSING:"

BTW: removing lines is not a good solution, at least not if you want it to output all cracked hashes. So you should prefer fixing the lines instead of removing them, otherwise you shouldn't complain that there are only 3k lines outputted

[eddow]

Fixed it with this REGEX;

Code:

^[:].*