Attack mode 6 and 7 give vastly different speeds

[OqQCP78Bz]

Hi all,

I'm using hashcat v5.1.0 with 2x GTX980Ti's and the latest nVidia drivers on windows 10 x64

I'm trying to use a ?a modifier on the left hand side of a word list and then a right hand side of the word list however the speed difference between the two is significant as per below: 

When I use the following command for -a 6:

Code:

C:\hashcat-5.1.0>hashcat64.exe -m 1000 -a 6 NTLM.txt --username "C:\Wordlists\crackstation.txt\realuniq.lst" ?a -O -w 3

Speed.#1.........:   845.9 MH/s (32.26ms) @ Accel:128 Loops:95 Thr:1024 Vec:1

Speed.#2.........:   879.8 MH/s (31.98ms) @ Accel:128 Loops:95 Thr:1024 Vec:1
Speed.#*.........:  1688.1 MH/ss

And for -a 7 I get

Code:

C:\hashcat-5.1.0>hashcat64.exe -m 1000 -a 7 NTLM.txt --username ?a "C:\Wordlists\crackstation.txt\realuniq.lst" -O -w 3

Speed.#1.........:   212.8 MH/s (28.67ms) @ Accel:128 Loops:95 Thr:1024 Vec:1

Speed.#2.........:   226.8 MH/s (28.40ms) @ Accel:128 Loops:95 Thr:1024 Vec:1
Speed.#*.........:   439.6 MH/s

I've included the --username as the NTLM.txt file has the usernames as well. Removing the usernames from the file and dropping the --username flag doesn't seem to change anything. 

Am I missing something obvious here? How can I get the speed of -a 7 to match that of -a 6?

Thanks!

[undeath]

https://hashcat.net/faq/morework

[OqQCP78Bz]

Sorry undeath, I don't understand what portion of that is relevant.

Are you implying that a 15GB word list + mask isn't enough work for hashcat to utilize the GPUs?

I also don't understand why a hybrid attack works fast on one side and slow on the other?

Apologies for not understanding, i'm confused.

[undeath]

I'm not implying anything, it's explained right in that FAQ article. Your mask is too small to be a useful amplifier for a very fast hash type like NTLM.

[OqQCP78Bz]

Okay. That would make sense if -a 6 was also going the same speed. Is there some other fundamental difference between -a 6 and -a 7 other than the side the mask is on?

I _do_ notice a substantial increase in speed when using the mask ?a?a?a vs ?a

But my issue isn't that the cracking isn't up to speed, its that the speed of the cracking differs based on which side the mask is on.

[undeath]

The left side of an attack has a higher impact on the performance than the right side. Since your left side for a7 only has 95 items you get worse performance than with the huge wordlist on a6. This is also the case for a1 and even a3.

[OqQCP78Bz]

Okay cool.
After re-reading that with your comments above I think I understand.
So, this is expected behaviour and essentially, for what I want to do, there's little I can change to get it to go any faster on the left side?

[philsmd]

you could try to think about alternatives, like rule based attacks (https://hashcat.net/wiki/?id=rule_based_attack)

Code:

hashcat64.exe --stdout -a 3 -o my.rules ^^?a

note: here I assume that the rule ^x will be put in the file my.rules, for each x in ?a. I think on windows you need to escape a ^ on the command line with ^^ but I could be wrong (the rule is just ^y for prepending the character y)

Code:

hashcat64.exe -m 1000 --username -a 0 -O -w 3 -r my.rules NTLM.txt "C:\Wordlists\crackstation.txt\realuniq.lst"

or other clever alternatives...


btw: I'm not saying that it must be faster, but you will see the speed difference and come up with maybe other alternatives yourself. also note that such workarounds/tricks only make sense for very specific inputs (in this case a very small mask ?a), it's not true/faster all the time, of course.

[undeath]

edit: ninja'd

Yes, the speed difference is because that's just how hashcat works and for fast hashes there is no good workaround. You may be able to achieve slightly better speed by using a0 with rules for appending/prepending characters instead of a6/a7. That would also allow you to combine both attacks into one.

[OqQCP78Bz]

Thanks greatly for your help undeath and philsmd.
Your time and help has been much appreciated!