Problem with cracking Office password that contains custom character

[philsmd]

why don't you just explain what you did and how you run it. That might reveal the problem you are facing much faster:

Code:

hashcat.exe -a 3 -m 9600 --hex-charset --self-test-disable hash.txt 0d01

[jerkdavi]

**Sorry, posted from my mobile and the text format was terrible. Reposting from computer.
Managed to get it to work with the help of your last code example.
This is the command I run:

Code:

hashcat.exe -a 3 -m 9600 -1 charsets/standard/Croatian/cro.hcchr -2 charsets/standard/Croatian/cro2.hcchr --hex-charset -o crack2.txt hash.txt ?1?2 --session=ime --self-test-disable

This is my candidates.#1 line:

Code:

Candidates.#1....: $HEX[0d01] -> $HEX[7d01]

The only problem I have with this is that it stores the password in hash.txt file in the next format '0d01' and not as the letter 'č'.
cro.hcchr and cro2.hcchr cover all of the letters in my native language which do not exist in English language.
I can crack Excel password that contain one letter from my alphabet.

Now I run into problems with Excel passwords which contain multiple letters including custom character letters. I encrypted the Excel file with the password 'čać'. I try to run the next command but get confusing results in candidates.#1 line:

Code:

hashcat.exe -a 3 -m 9600 -1 charsets/standard/Croatian/cro.hcchr -2 charsets/standard/Croatian/cro2.hcchr --hex-charset -o crack2.txt hash.txt ?1?2?l?1?2 --session=ime --self-test-disable

Code:

Candidates.#1....: $HEX[6101616101] -> $HEX[61017a7e01]

It finishes with status Exhausted. What should I do next.

[jerkdavi]

Should i convert all of the letters to hex and put them in my cro.hcchr and cro2.hcchr files?

[philsmd]

unfortunately, there is no way to fully get it without trying to learn about character encoding and what utf16le means etc.
There is no shortcut. You need to understand the way characters are represented and how ascii / utf8 chars are converted to utf16le etc:

Code:

echo -n čać | iconv -f utf8 -t utf16le | xxd -p
0d0161000701

so in this case only this would work:

Code:

--self-test-disable --hex-charset -2 0001070d61 hash.txt ?2?2?2?2?2?2

the password is 3 x 2 characters long: 0x0d01 for the utf8 character č , 0x6100 for the character a, and 0x0701 for the multi-byte utf8 character ć