Notes by mraabo

Hashcat

Properties1
tagscomputer-security

A tool for Password Cracking.

Supports over 320 hash types, in Hashcat called hash modes.

It is recommended to find possible hash-types with Hashid first.

Commands

hashcat hash|hashfile|hccapxfile [wordlist|mask|directory] [options]

Options

  • -m <integer> | --hash-type <integer>: Use hash mode that is mapped to <integer>, see below.
  • -a <integer> | --attack-mode <integer>: attack mode mapped to <integer>, see below.
  • --show: show results of cracked passwords.
  • --force: Ignore warnings, never use this as it can give false results.
  • -b: benchmark hash modes
  • -r <rule file>: apply the rules to each word in the Wordlists to construct an altered wordlist that adheres to the rules, see below.
  • -g <int>: use <int> generated random rules, see below.

Optimisations

  • -O: enable kernel optimisation
  • -w: enable workload file. Default is 2, chose 1 if using computer while running Hashcat and 3 to dedicate computer to Hashcat.

Hash modes

Hash types that are mapped to numbers, that can be seen with hashcat -hh.

Some common ones are:

  • 0: MD5
  • 100: SHA1
  • 1000: NTLM
  • 1800: sha512crypt, SHA512 (Unix)
  • 3200: bcrypt, Blowfish (Unix)
  • 5500: NetNTLMv1 / NetNTLMv1+ESS
  • 5600: NetNTLMv2
  • 13100: Kerberos 5 TGS-REP etype 23

Attack modes

Attack modes are different strategies Hashcat uses to generate password candidates that it will test against a given hash.

Some common ones are:

  • 0: Straight - tests each word from a single list as-is.
  • 1: Combination - concatenate words from two wordlists together (e.g., cat + dog).
  • 3: Brute Force Attack
  • 6: Hybrid Attack (Wordlist + mask) - starts with a word and appends random characters determined by the mask. Also write the arguments in that order.
  • 7: Hybrid Attack (mask + Wordlist) - starts with random characters determined by the mask and ends with a word. Also write the arguments in that order.
  • 9: Association

Masks

The following formats can be used for mask attacks that use masks instead of wordlists:

  • ?l: lower-case ASCII letters (a-z)
  • ?u: upper-case ASCII letters (A-Z)
  • ?d: digits (0-9)
  • ?h: 0123456789abcdef
  • ?H: 0123456789ABCDEF
  • ?s: special characters («space»!”#$%&’()*+,-./:;<=>?@[]^_`{
  • ?a: ?l?u?d?s
  • ?b: 0x00 - 0xff

One can also make custom charsets with -<int> <charset> which are referred to with ?<int>, where <int> serves as a variable name that ranges from 1 to 4.

Rules

Rules are operations performed on words in the Wordlist and can be seen as an advanced version of masks.

It is possible to generate <int> number of random rules with -g <int>, or specific in-built or custom rules can be chosen with -r <rule>.

In-built Rules

Hashcat comes with many rules in /usr/share/hashcat/rules/. It is usually better to try these before building custom rules.

Other rules can be found at:

Custom Rules

We can build custom rules with the following functions:

  • l: convert all letters to lowercase
  • u: convert all letters to uppercase
  • c: capitalise first letter and invert the rest
  • C: lowercase first letter and invert the rest
  • t: toggle case whole word
  • TN: toggle case at position n
  • d: duplicate word
  • q: duplicate all characters
  • zN: duplicate first character
  • ZN: duplicate last character
  • {: rotate word left
  • }: rotate word right
  • ^<char>: prepend character <char>
  • $<char>: append character <char>
  • r: reverse

Examples

Custom charset masks

-1 02 'hashcat?1

where -1 is the variable name of the charset 02, i.e. the char 0 or the char 2, and ?1 is the placeholder, i.e. the position to inset the charset.

This means that we have made a mask that will try the strings hashcat0 and hashcat2.

Hybrid attack (mode 6)

We can use the hybrid attack by using words in rockyou.txt and appending a digit and special char at the end of these words with the mask ?d?s:

hashcat -a 6 -m 0 hybrid_hash /opt/useful/seclists/Passwords/Leaked-Databases/rockyou.txt '?d?s'

Custom rules

echo 'c so0 si1 se3 ss5 sa@ $2 $0 $1 $9' > rule.txt

The first letter word is capitalised with the c function. Then rule uses the substitute function s to replace o with 0, i with 1, e with 3 and a with @. At the end, 2019 is appended to it.

This is a sort of l33tspeak that we test on password_ilfreight:

echo 'password_ilfreight' > test.txt
hashcat -r rule.txt test.txt --stdout
 
P@55w0rd_1lfr31ght2019

Sources

Graph View

Backlinks