Cracking ethereum wallet password

[g-t]

Hi,
I've been trying to recover my friend's ethereum password. As far as I know him I suspect it can't be very difficult password.

I've downloaded latest hashcat version which should support ethereum wallet (scrypt) password cracking (mode 15700).
I was trying to run it on gpus (6x radeon 580 mining rig) but it hangs the machine completely. I also read some articles about scrypt and it turns out that for n=262144 gpu cracking shouldn't work so I decided to try old-school cpu cracking.

I can see my cpu in hashcat:

Code:

 hashcat-4.0.1 ./hashcat64.bin -I hashcat (v4.0.1) starting... clGetDeviceIDs(): CL_DEVICE_NOT_FOUND OpenCL Info: Platform ID #1  Vendor  : The pocl project  Name    : Portable Computing Language  Version : OpenCL 2.0 pocl 0.14, LLVM 4.0.0  Device ID #1    Type           : CPU    Vendor ID      : 128    Vendor         : GenuineIntel    Name           : pthread-Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz    Version        : OpenCL 2.0 pocl HSTR: pthread-x86_64-unknown-linux-gnu-haswell    Processor(s)   : 8    Clock          : 3500    Memory         : 17888/17888 MB allocatable    OpenCL Version : OpenCL C 2.0    Driver Version : 0.14 Platform ID #2  Vendor  : Mesa  Name    : Clover  Version : OpenCL 1.1 Mesa 17.2.4 Platform ID #3  Vendor  : Intel(R) Corporation  Name    : Intel(R) OpenCL  Version : OpenCL 2.0 LINUX  Device ID #2    Type           : CPU    Vendor ID      : 8    Vendor         : Intel(R) Corporation    Name           : Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz    Version        : OpenCL 2.0 (Build 37)    Processor(s)   : 8    Clock          : 2600    Memory         : 3960/15840 MB allocatable    OpenCL Version : OpenCL C 2.0    Driver Version : 1.2.0.37

I'm trying to run cracking like that:

Code:

➜  hashcat-4.0.1 ./hashcat64.bin -m15700 "\$ethereum\$s*262144*8*1*1ebcc...bdd12f*4e065...5af0366*f86586319...8df" --status --status-timer=5 -w3 --opencl-platforms=3

but the app constantly prints:

Code:

Session..........: hashcat Status...........: Running Hash.Type........: Ethereum Wallet, SCRYPT Hash.Target......: $ethereum$s*262144*8*1*1ebc...c477a9...0a88df Time.Started.....: Wed Dec 20 14:47:05 2017 (5 secs) Time.Estimated...: Wed Dec 20 14:47:10 2017 (0 secs) Guess.Base.......: Pipe Speed.Dev.#1.....:        0 H/s (1278.98ms) Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts Progress.........: 0 Rejected.........: 0 Restore.Point....: 0 Candidates.#1....: [Copying] HWMon.Dev.#1.....: N/A

I was also wondering if something's wrong with my computer that runs Fedora Core but the same happens on two different computers with Windows 10.

Another weird thing is benchmarking. I ran hashcat64.bin --benchmark and everything went fine but didn't benchmark mode 15700. I can see 15600 but 15700 is missing.

Code:

Hashmode: 15600 - Ethereum Wallet, PBKDF2-HMAC-SHA256 Speed.Dev.#1.....:      124 H/s (53.49ms)

Here's part of wallet.json:

Code:

 "crypto": {    "cipher": "aes-128-ctr",    "ciphertext": "4e0653b69...e462c9c...cdc998b8...0366",    "cipherparams": {      "iv": "90258a3...0b897a3dc2aaf"    },    "kdf": "scrypt",    "kdfparams": {      "dklen": 32,      "n": 262144,      "p": 1,      "r": 8,      "salt": "1ebcc...c477a90ad...c74a9...d12f"    },    "mac": "f86...fc22dce...87d6f9874...0a88df"

Am I doing something wrong ? Would appreciate any help.

[undeath]

first, do not post hashes.

second, you are not specifying an attack mode and corresponding settings, hence hashcat defaults to stdin mode with a0.

[g-t]

first, do not post hashes.

second, you are not specifying an attack mode and corresponding settings, hence hashcat defaults to stdin mode with a0.

Right. I've just added -a 3 and it works. Thanks. Just thought it defaults to brute force. By the way could you recommend some brute force settings in such case ? Is it really impossible to use gpus ?

[undeath]

If you don't specify a mask hashcat will use a default one which is probably not what you want. Anyway, cracking such a wallet with bf is near impossible unless the password is very short (and you know that).