My Itunes hash

[Andy1975]

Hi,

I'm new here and i have still my problems with hashcat.

So here is my Problem. I lost my password for Itunes and unfurtantely there where all my holiday pictures on it.

I have an idea which systematic my password has, but i don't know the length of it.

It Should be:
1. digit: capital letters
2. digit: small letters
3. digit- x. digit: numbers
x+1. digit: additional characters
x+2. digit - y. digit: numbers

So i tried with a mask bruteforce:

hashcat64 -m 14800 -a 3 "$itunes_backup$*10*...*10000*...*10000000*..." andy.hcmask

The andy.hcmask file has the content:
?u?l?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s
?u?l?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s?d,?s

Can anybody help me?

Thanks

Andy
[url=https://dict.leo.org/englisch-deutsch/additional][/url]

[philsmd]

I must admit that I didn't understand at all what you mean by this x+1 and x+2, y etc... but I would recommend that you just read the documentation on how to use hashcat mask files (.hcmask):
1. https://hashcat.net/wiki/doku.php?id=fre..._mask_file
2. https://hashcat.net/wiki/doku.php?id=mas...mask_files

The idea is very easy. You always need a mask within your lines of a hashcat mask file (.hcmask).
If you need to use custom charsets (that are not just built-in charset but combined or custom chars) you also need to define the custom charsets. The format is as mentioned above, therefore either:
mask
or
CS1,maskUsingCS1
or
CS1,CS2,maskUsingCS1andCS2
or
CS1,CS2,CS3,maskUsingCS1andCS2andCS3
or
CS1,CS2,CS3,CS4,maskUsingCS1andCS2andCS3andCS4

The range of custom charsets is from 0 to 4 custom charsets. Again, if you want to use built-in charsets or a single byte-long constant substring (char) you do not need to use any custom charset at all for that position.

I think what you are currently not aware of is that the definition of a custom charset is not the same as the concept of a mask, which is using built-in charsets, custom charset and constant chars. These are 2 very distinct concepts. The former defines a set of characters (like a variable) and the latter (the mask) defines the length and per-position use of the chars.
A hashcat mask file always needs to have a mask within each line, while definition of character sets are only needed/meaningful if you need them within your mask (within that specific line).

I think the FAQ/wiki sections should be easy enough to get you started with defining your own hashcat mask files. BTW: there are even some tools like policygen.py from PACK that could help in automatically generating hashcat mask files (altrough I'm not totally sure if it is applicable to your specific scenario, because I honestly didn't really understand your "rules", especially the x+1, x+2, y etc rules)

---

btw: it could also make sense to just post some example passwords that follow your "rules" and maybe somebody could help you to come up with a hashcat mask file which catches all of those passwords. Of course the password list should demonstrate most/all of the "rules" such that the hcmask file can be defined correctly and matches all the policies/rules

[Andy1975]

I must admit that I didn't understand at all what you mean by this x+1 and x+2, y etc... but I would recommend that you just read the documentation on how to use hashcat mask files (.hcmask):
1. https://hashcat.net/wiki/doku.php?id=fre..._mask_file
2. https://hashcat.net/wiki/doku.php?id=mas...mask_files

The idea is very easy. You always need a mask within your lines of a hashcat mask file (.hcmask).
If you need to use custom charsets (that are not just built-in charset but combined or custom chars) you also need to define the custom charsets. The format is as mentioned above, therefore either:
mask
or
CS1,maskUsingCS1
or
CS1,CS2,maskUsingCS1andCS2
or
CS1,CS2,CS3,maskUsingCS1andCS2andCS3
or
CS1,CS2,CS3,CS4,maskUsingCS1andCS2andCS3andCS4

The range of custom charsets is from 0 to 4 custom charsets. Again, if you want to use built-in charsets or a single byte-long constant substring (char) you do not need to use any custom charset at all for that position.

I think what you are currently not aware of is that the definition of a custom charset is not the same as the concept of a mask, which is using built-in charsets, custom charset and constant chars. These are 2 very distinct concepts. The former defines a set of characters (like a variable) and the latter (the mask) defines the length and per-position use of the chars.
A hashcat mask file always needs to have a mask within each line, while definition of character sets are only needed/meaningful if you need them within your mask (within that specific line).

I think the FAQ/wiki sections should be easy enough to get you started with defining your own hashcat mask files. BTW: there are even some tools like policygen.py from PACK that could help in automatically generating hashcat mask files (altrough I'm not totally sure if it is applicable to your specific scenario, because I honestly didn't really understand your "rules", especially the x+1, x+2, y etc rules)

---

btw: it could also make sense to just post some example passwords that follow your "rules" and maybe somebody could help you to come up with a hashcat mask file which catches all of those passwords. Of course the password list should demonstrate most/all of the "rules" such that the hcmask file can be defined correctly and matches all the policies/rules

Hi the password I'm looking for should be in this structure:

Andy-1234567890_01234567890

I don't know the length of the numbers, but I would use my specific numbers, which I use else.

Thanks

[undeath]

What is the expected length of each part of the password? Doing a full brute force is probably not feasible.

to summarise, your password consists of

word with capital letter
+ special char
+ numbers
+ special char
+ numbers

where you have more narrow candidates for both numbers, correct?