separator mismatch on old office hash 9720

[daryl178@cox.net]

I'm getting a token length error on the following Excel hash:


$oldoffice$0*c80c451496dc9459eb60d7bf73cdf4bb*b3487d522b7b724756fe6418d149b073*9d0f73f403c99a078bf8f7c7e7f5ba7b

my commands have been:

hashcat64.exe -m 9720 -a 3 --increment --increment-min 4 --show  JulAugV2.hash ?a?a?a?a?a?a?a?a

Mode 9720 matches the example hash. I compared the generated hashes from hashcat and JTR.

I have also tried:
hashcat64.exe -m 9710  -a 3 --increment  --show JulAugV2.hash ?a?a?a?a?a?a?a?a

but hashcat exits quietly (no messages).

Here is the command output:

y:\hashcat-5.1.0>hashcat64.exe -m 9720  -a 3 --increment  --show JulAugV2.hash ?a?a?a?a?a?a?a?a
Hashfile 'JulAugV2.hash' on line 1 ($oldof...9d0f73f403c99a078bf8f7c7e7f5ba7b): Separator unmatched
No hashes loaded.


y:\hashcat-5.1.0>type JulAugV2.hash
$oldoffice$0*c80c451496dc9459eb60d7bf73cdf4bb*b3487d522b7b724756fe6418d149b073*9d0f73f403c99a078bf8f7c7e7f5ba7b

y:\hashcat-5.1.0>

I have tried version 6.1.1 with the same result.

Does anyone have any corrections?

[slyexe]

The hash is 9710 and works fine on 6.1.1 on my system. Must be something wrong with your .hash file as there could be a break or space at the end of the hash. Otherwise, adding the hash thru cmd prompt works just dandy for myself. 

Code:

hashcat.exe -m 9710 -d 2 -a 3 $oldoffice$0*cxxxxxxxxxxxx*9d0f73f403cxxxxxxxxxxxxxx7b ?a?a?a?a?a

Code:

Session..........: hashcat
Status...........: Running
Hash.Name........: MS Office <= 2003 $0/$1, MD5 + RC4, collider #1
Hash.Target......: $oldoffice$0*c80c451496dc9459eb60d7bf73cdf4bb*b3487...f5ba7b
 Time.Started.....: Wed Feb 10 15:14:25 2021 (19 secs)
 Time.Estimated...: Wed Feb 10 15:18:25 2021 (3 mins, 41 secs)
Guess.Mask.......: ?a?a?a?a?a [5]
 Guess.Queue......: 1/1 (100.00%)
 Speed.#2.........: 32155.0 kH/s (5.46ms) @ Accel:32 Loops:23 Thr:64 Vec:1
  Recovered........: 0/1 (0.00%) Digests
Progress.........: 618577920/7737809375 (7.99%)
 Rejected.........: 0/618577920 (0.00%)
Restore.Point....: 6471680/81450625 (7.95%)
 Restore.Sub.#2...: Salt:0 Amplifier:46-69 Iteration:0-23
Candidates.#2....: R>jO1 -> XpcSO
 Hardware.Mon.#2..: Temp: 55c Fan: 80% Util: 98% Core:1440MHz Mem:8000MHz Bus:16

[daryl178@cox.net]

The hash is 9710 and works fine on 6.1.1 on my system. Must be something wrong with your .hash file as there could be a break or space at the end of the hash. Otherwise, adding the hash thru cmd prompt works just dandy for myself. 

Code:

hashcat.exe -m 9710 -d 2 -a 3 $oldoffice$0*cxxxxxxxxxxxx*9d0f73f403cxxxxxxxxxxxxxx7b ?a?a?a?a?a

Code:

Session..........: hashcat
Status...........: Running
Hash.Name........: MS Office <= 2003 $0/$1, MD5 + RC4, collider #1
Hash.Target......: $oldoffice$0*c80c451496dc9459eb60d7bf73cdf4bb*b3487...f5ba7b
 Time.Started.....: Wed Feb 10 15:14:25 2021 (19 secs)
 Time.Estimated...: Wed Feb 10 15:18:25 2021 (3 mins, 41 secs)
Guess.Mask.......: ?a?a?a?a?a [5]
 Guess.Queue......: 1/1 (100.00%)
 Speed.#2.........: 32155.0 kH/s (5.46ms) @ Accel:32 Loops:23 Thr:64 Vec:1
  Recovered........: 0/1 (0.00%) Digests
Progress.........: 618577920/7737809375 (7.99%)
 Rejected.........: 0/618577920 (0.00%)
Restore.Point....: 6471680/81450625 (7.95%)
 Restore.Sub.#2...: Salt:0 Amplifier:46-69 Iteration:0-23
Candidates.#2....: R>jO1 -> XpcSO
 Hardware.Mon.#2..: Temp: 55c Fan: 80% Util: 98% Core:1440MHz Mem:8000MHz Bus:16

Thank you slyexe. Specifying the hash on the commandline was a good pointer. I removed the line ending (0x0d0x0a) for this particular hash file and hashcat started working. Just like other hashes, I simply redirected straight from office2hashcat.py and didn't focus on the line ending. Since the file was old, I thought I had some ancient combination. I appreciate it.