mask help

[zumba]

Hi guys,

I'm a newbie with a problem. Some months ago I password protected a word 2013 document (because paranoia) and didn't write down the password. Of course I forgot the password and now I am getting a bit desperate as I need that doc for my job. 

This is how I got to hashcat. I looked up how this can be done, managed to extract the hash and got hashcat running and doing it's job. I believe that my password was strictly alphanumeric and of maximum 8 characters. I came up with this: 

hashcat64.exe -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 my_word_hash.txt 

However I have no ideea what I can do to improve the odds of finding the pass, although I am pretty sure that I did not put more then 1 numeric character in there somewhere (most likely either at the beginning of at the very end). When I start hashcat I get the following message:

The wordlist or mask you are using is too small.

Therefore, hashcat is unable to utilize the full parallelization power of your device(s).
The cracking speed will drop.
Workaround: https://hashcat.net/wiki/doku.php?id=fre...full_speed

INFO: approaching final keyspace, workload adjusted

I am not sure that that means and although I did read online about this warning, tbh I feel like I am way out of my league here. 

If anyone could help with some advice, it would be very much appreciated. I would like to get a p2.x8large Amazon instance to try to get some juice under the hood for this job, but it would be nice to know that I am not throwing my hard earned money out the window with a poor hashcat request. 

Many thanks

[royce]

You'll need to be realistic about your odds.  You can improve them a bit, but it will take some work.

Office 2013 hashes are extremely slow. On my GTX 970, I only get about 4000 hashes per second once I start supplying a lot of work.

Also, note that your command line should explicitly specify the actual mask (these are not tested, just examples):

hashcat64.exe -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 my_word_hash.txt ?1?1?1?1?1?1?1?1

When you start the run, you'll see that it starts with the four-character mask first (?1?1?1?1). Let it run for 20 seconds or so, then hit Enter to refresh status, and then note the time estimate. Then hit 'b' for 'bypass' to repeat the procedure to see the time estimate for five characters, etc. Once you get above 6 chars, you'll see that it's going to take a very long time.

hashcat --session=t2 -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 o13.hash ?1?1?1?1?1?1?1?1

hashcat (v3.30-310-g30e3ad6) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 970, 1009/4036 MB allocatable, 13MCU
* Device #2: GeForce GTX 750 Ti, 500/2000 MB allocatable, 5MCU

[snip]

Session..........: t2
Status...........: Running
Hash.Type........: Office 2013
Hash.Target......: $office$*2013*100000*256*16*7dd611d7eb4c899f74816d1dec817b3b*948dc0b2c2c6c32f14b5995a543ad037*0b7ee0e48e935f937192a59de48a7d561ef2691d5c8a3ba87ec2d04402a94895
Time.Started.....: Fri Feb 17 07:27:37 2017 (10 secs)
Time.Estimated...: Fri Feb 17 07:33:53 2017 (6 mins, 6 secs)
Input.Mask.......: ?1?1?1?1 [4]

Input.Charset....: -1 ?l?d, -2 Undefined, -3 Undefined, -4 Undefined
Input.Queue......: 1/5 (20.00%)
Speed.Dev.#1.....:     3382 H/s (3.16ms)
Speed.Dev.#2.....:     1193 H/s (3.39ms)
Speed.Dev.#*.....:     4571 H/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 0/1679616 (0.00%)
Rejected.........: 0/0 (0.00%)
Restore.Point....: 0/46656 (0.00%)
Candidates.#1....: sari -> sqg4
Candidates.#2....: sar0 -> sqgq
HWMon.Dev.#1.....: Temp: 48c Fan: 35% Util: 99% Core:1265Mhz Mem:3004Mhz Lanes:8
HWMon.Dev.#2.....: Temp: 34c Fan: 32% Util: 99% Core:1163Mhz Mem:2700Mhz Lanes:8

[snip]

Time.Started.....: Fri Feb 17 07:27:50 2017 (2 secs)
Time.Estimated...: Fri Feb 17 11:55:27 2017 (4 hours, 27 mins)
Input.Mask.......: ?1?1?1?1?1 [5]

[snip]

Time.Started.....: Fri Feb 17 07:28:03 2017 (11 secs)
Time.Estimated...: Wed Feb 22 12:37:08 2017 (5 days, 5 hours)
Input.Mask.......: ?1?1?1?1?1 [6]

[snip]

Time.Started.....: Fri Feb 17 07:32:49 2017 (24 secs)
Time.Estimated...: Sat Aug 19 20:44:03 2017 (183 days, 12 hours)
Input.Mask.......: ?1?1?1?1?1?1?1 [7]


You can reduce this a little bit by generating a list of masks that only have at most one digit in them, and feeding that list to hashcat. The PACK toolkit (Python) has a tool called 'policygen' to do this:

./policygen.py --pps 4000 --minlength=4 --maxlength=8 --mindigit=1 --maxdigit=1 --maxspecial=0 --showmasks >masks.txt

You can then specify the masks.txt filename instead of the mask:

hashcat64.exe -a 3 -m 9600 -o found.txt -1 ?l?d -i --increment-min=4 --increment-max=8 my_word_hash.txt masks.txt

If there's anything else that you can recall about the password, try to reduce the keyspace as much as you can. Good luck!

[zumba]

Thank you so much for your reply. I see now that without some massive increase in performance (or cash to run it for days on Amazon) there is no way I am going to break this.

[zumba]

I usually make my passwords with just 1 numeric in front of the pass or as last digit, in between being only alphabetic characters.

If I try out masks using only that, is this a correct syntax for a password with 4 chars with the first one being numeric ?

hashcat64.exe --session=t2 -a 3 -m 9600 -o found.txt -1 ?d?l?l?l -i --increment-min=4 --increment-max=8 my-hash.txt

[zumba]

Also I usually only put capital letters in the beginning ( I know, not very good with passwords). Can this help me narrow down the search even further ?

[royce]

When incrementing, your mask needs to be as long as your increment maximum, so your syntax needs to be adjusted accordingly:

?d?l?l?l?l?l?l?l

And yes, anything you can do to narrow it down will help. For example, for just plains that start with a digit, the next two characters only upper-case, and chars 4 through 8 could be upper or lower but not digit or special, you can define a custom character set. You can define up to four (-1, -2, -3, -4). I usually start with -2 for readability unless I need all four sets.

-2 ?l?u ?d?u?u?2?2?2?2?2

And if you think that the fourth character is an A, a, or @, then you can get very specific:

-2 ?l?u -3 Aa@ ?d?u?u?3?2?2?2?2

You get the idea. Definitely read the mask-attack documentation carefully, so that you get the maximum amount of reduction of the keyspace. And you can watch the time estimates to see the impact of your work.

[miccee]

 I usually start with -2 for readability unless I need all four sets.

Nice tip, thanks! I never thought of that... always had to squint my eyes for ?l and ?1.