Noob Extracting VeraCrypt MBR

[ButterToast1134]

-m 13741 -a 0

GTX1080 - 1231 H/s
GTX960 - 298 H/s

After 24 Hours:

GTX1080 - 1031 H/s
GTX960 - 243 H/s

Forget VeraCrypt!

Haha. Well to try the 50 million I generated its 368h/s so 50,000,000 / 368 is 135,869 seconds / 60 2264 mins / 60 37.7 hours / 24 1.5 days.

Ive been running for 2 hours 28 mins. Says 1 day 11 hours left.

[kiara]

-m 13741 -a 0

GTX1080 - 1231 H/s
GTX960 - 298 H/s

After 24 Hours:

GTX1080 - 1031 H/s
GTX960 - 243 H/s

Forget VeraCrypt!

Haha. Well to try the 50 million I generated its 368h/s so 50,000,000 / 368 is 135,869 seconds / 60 2264 mins / 60 37.7 hours / 24 1.5 days.

Ive been running for 2 hours 28 mins. Says 1 day 11 hours left.

if u want, come to the hashcat IRC and pm me there with the binary and the mask that u want.
i will try to help u out

[atom]

This has nothing to do with the hash used, it's all just the iteration count. If you iterate MD5 a million times it would be even slower.

[ButterToast1134]

This has nothing to do with the hash used, it's all just the iteration count. If you iterate MD5 a million times it would be even slower.

I'm not understanding what you mean? Since a 10 character MD5 is 781e5e245d69b566979b86e28d23f2c7 for the string 0123456789.

Where as SHA512 BB96C2FC40D2D54617D6F276FEBE571F623A8DADF0B734855299B0E107FDA32CF6B69F2DA32B36445D73690B93CBD0F7BFC20E0F7F28553D2A4428F23B716E90 is the same string. Isn't it slower at hashing because you have to generate a much longer hash?

Aside from that, I know the first 10 characters of my password. I know its 20 characters total. I believe I used 1 3 4 ! and possibly 6 in those last 10.

So I am running

Code:

hashcat64.exe -m 13721 -a 3 -w 3 -o Z:\cracked.txt -1 1346! Z:\(hash file) Disposable?1?1?1?1?1?1?1?1?1?1

Which is generating me Disposable(combinations of 1 3 4 6 !).

So 5 characters at 10 positions 5^10 is 9,765,625 different combinations.

At 249h/s (I switched to SHA512 and AES 512 since thats the Veracrypt defaults) its going to take ~11 hours which is a much more reasonable time haha.

Thanks for the help and hope I crack it.

Great program Atom mad props.

[philsmd]

atom was not speaking about the output length but about the details of the algorithm, i.e. whenever you have to apply the same hashing function thousand or even millions of times, the speed will be dropping accordingly (almost perfectly proportional). We can't make any direct conclusion/relations when we look at just output length and speed (the algorithm details and as said the iteration count is much more significant).

BTW: a fixed prefix within the mask is almost never going to give you the full speed. you might consider looking at other attack modes too (like -a 6 dictionary + mask). While this doesn't really matter too much for Veracrypt (slow algo), you shouldn't stick to the habbit to use a hardcoded prefix within the mask (especially for fast hashes like MD5).

[ButterToast1134]

So I've run it a couple times using different algorithms and still haven't gotten it.

I am going to verify that the 512 bytes is the correct bytes I need by dd the hard drive again.

Noticed there is this setting.

Code:

6 = PBKDF2-HMAC-SHA256 + boot-mode  

I forgot to mention that this was the operating system drive (C: because its Windows 7).
Before the operating system even boots I had to type in my password.

Does that mean I should be using boot-mode?

[atom]

Yes, you need the boot mode. Note that there's also a whirlpool boot mode. If you don't know which hash was used you need to run through both modes.

[ButterToast1134]

Yes, you need the boot mode. Note that there's also a whirlpool boot mode. If you don't know which hash was used you need to run through both modes.

Thanks. I just used the standard settings so it should be SHA256 + boot with AES 512.

13761 (SHA256 + boot and AES 512)

Thanks very much Atom. Will update if I recover.

[ButterToast1134]

Another newbie question.

I haven't had any luck yet.

Starting with Windows 7 (I think) Windows would create a 100MB partition, then your normal partition then a 450MB partition at the end for recovery.

Are the keys stored in the last 512 bytes of sector 0 in the 100MB partition or in the normal partition?

"in case of a physical disk you need to copy the last 512 bytes of the *first logical volume*."

I'm currently searching google to see what you mean by first logical volume. If that is the 100MB partition or the C: partition.

[ButterToast1134]

I went through the keyboard and wrote down all the characters I use in my passwords. Which left me with 26 characters. Obviously 26^20 is impossible to crack.

But for the letters I always use certain words.

How would I go about telling hashcat to keep certain letters always together to spell our a word?

Like one of the words I use is disposable. How would I tell hashcat to keep disposable as a word, and say I use cat as another word, how would I tell hashcat to try say disposablecat1111111 then try disposable1111111cat, catdisposable1111111, cat1111111disposable ect?