2x GTX 1080ti + 1070 on MD5 /NTLM very very slow

[alish]

Yes that's perfectly normal. With multiple hashes there's some optimization that we can not do.

Ok, i got 2 more questions:

0) if u got hunders of ntlm hashes (during pentest ), what would you advice from efficiency point of view,  how to crack them very fast except rules + wordlists. -a3 as only cracking option seems to be slow.

1) my   mask  was ?l?l?l?l?l?l?l?l?a?a . you offered ?a?a?l?l?l?l?l?l?l?l   ? Both have same amount of possible words:  1884664257798400 = 1884664257798400. My mask says: all beginning 6 chars are lowcase, 7th and 8th are could be any char. But your mask says: first 2 are any char, rest only lowercase. second mask doesnt include all pwds from first mask? 

If say, file contains one hash,  pwd length is 10   lowercase + only latin alphabet, this would be: ?l?l?l?l?l?l?l?l?l?l with 72763.5 MH/s in 32min. For len 9, same result.
mask -a3 ?1?1?1?1?1?1?1?1?1?1 -1 abcdefghijklmnopqrstuvwxyz returns same result. 
with your mask ?a?a?l?l?l?l?l?l?l?l  it gets 135.8 GH/s but 3 hours, 51 mins because of keyspace.
 

So how to understand this behaviour of hashcat?

thanks





hashcat64.bin  -O -w3 -m 1000 tmp -a3 ?l?l?l?l?l?l?l?l?l?l
hashcat (v4.2.1) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1080 Ti, 2794/11178 MB allocatable, 28MCU
* Device #2: GeForce GTX 1080 Ti, 2794/11178 MB allocatable, 28MCU
* Device #3: GeForce GTX 1070, 2029/8119 MB allocatable, 15MCU

[s]tatus [p]ause ypass [c]heckpoint [q]uit => s

Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
Hash.Target......: 95b8437xxxxxxxxxxxxxxx
Time.Started.....: Sat Sep 29 15:12:09 2018 (1 sec)
Time.Estimated...: Sat Sep 29 15:44:28 2018 (32 mins, 18 secs)
Guess.Mask.......: ?l?l?l?l?l?l?l?l?l?l [10]
Guess.Queue......: 1/1 (100.00%)
[b]Speed.Dev.#1.....: 26379.0 MH/s (40.31ms) @ Accel:128 Loops:676 Thr:1024 Vec:2
Speed.Dev.#2.....: 26511.2 MH/s (40.48ms) @ Accel:128 Loops:676 Thr:1024 Vec:2
Speed.Dev.#3.....: 19873.3 MH/s (85.34ms) @ Accel:256 Loops:676 Thr:1024 Vec:2
Speed.Dev.#*.....: 72763.5 MH/s
[/b]Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 35441868800/141167095653376 (0.03%)
Rejected.........: 0/35441868800 (0.00%)
Restore.Point....: 44826624/208827064576 (0.02%)
Candidates.#1....: safkutseaa -> xzllpuafaa
Candidates.#2....: sangikjfaa -> xzkgdlrfaa
Candidates.#3....: saylpuafaa -> xzogikjfaa
HWMon.Dev.#1.....: Temp: 43c Fan: 23% Util: 99% Core:1809MHz Mem:5005MHz Bus:8
HWMon.Dev.#2.....: Temp: 42c Fan: 23% Util: 99% Core:1809MHz Mem:5005MHz Bus:8
HWMon.Dev.#3.....: Temp: 37c Fan: 27% Util:100% Core:1733MHz Mem:3802MHz Bus:4

[undeath]

0) https://hashcat.net/wiki/doku.php?id=fingerprint_attack
1) That's because of the way hashcat works internally. The left side should have as much work as possible. Together with NTLM being one of the fastest supported algorithms you run into that limitation with only ?l

You might be able to speed up that attack by running one hashcat instance per gpu and split the masks like
-1 abcdefgh ?l?l?l?l?l?l?l?l?l?1
-1 ijklmnopq ?l?l?l?l?l?l?l?l?l?1
-1 rstuvwxyz ?l?l?l?l?l?l?l?l?l?1
(not sure, try it)