Help cracking passwords with HASHCAT - Printable Version

Help cracking passwords with HASHCAT - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Help cracking passwords with HASHCAT (/showthread.php?tid=6210901)

Help cracking passwords with HASHCAT - mutate - Jun 25, 2022

So I'm on the website TryHackMe, and I'm doing a practice exercise where I need to crack this hash:

Code 
$2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom

Its a BCRYPT hash. I'm using the command statement to crack the hash:

Code 
sudo hashcat -m 3200 hash.txt '/home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt'

However, opposed to other hashes I've cracked within the last hour (MD5 and SHA-1) I get this error:

Code 
Dictionary cache hit:

* Filename..: /home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt

* Passwords.: 14344384

* Bytes.....: 139921497

* Keyspace..: 14344384

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s

Session..........: hashcat

Status...........: Running

Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))

Hash.Target......: $2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX...8wsRom

Time.Started.....: Sun Jun 26 01:01:24 2022 (3 secs)

Time.Estimated...: Wed Jun 29 17:08:19 2022 (3 days, 16 hours)

Kernel.Feature...: Pure Kernel

Guess.Base.......: File (/home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt)

Guess.Queue......: 1/1 (100.00%)

Speed.#1.........:       45 H/s (8.24ms) @ Accel:12 Loops:128 Thr:1 Vec:1

Recovered........: 0/1 (0.00%) Digests

Progress.........: 144/14344384 (0.00%)

Rejected.........: 0/144 (0.00%)

Restore.Point....: 144/14344384 (0.00%)

Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:3712-3840

Candidate.Engine.: Device Generator

Candidates.#1....: alejandro -> arsenal

Hardware.Mon.#1..: Temp: 68c Util: 86%

It tells me that I've received a 'cache-hit' which I've never gotten before, and as you can see above I've elected to view the status of the cracking.

It claims its still running. Is this correct? I couldn't find much information online about what a cache-hit was and I didn't know if anyone else has encountered this before.

Thanks!

Edit: When I choose the 'bypass' option, it simply quits hashcat without completing the job.

RE: Help cracking passwords with HASHCAT - mutate - Jun 25, 2022

(Jun 25, 2022 10:20 PM)shatter Wrote: It's not an error lol, it's just telling you that the data being referenced by hashcat, in this case, the dictionary, is found in memory.

To answer your question, if it claims it is still running, it's still running.

I see, thanks!. Also, what is a keyspace? Apparently, its not the amount of words in your wordlist. At least according to what I read online. I checked hashcat's help documents but didn't really get a finite answer.

RE: Help cracking passwords with HASHCAT - mutate - Jun 26, 2022

(Jun 26, 2022 08:53 AM)shatter Wrote: It's not the amount of words in the wordlist, it's the amount of possible combinations in your wordlist. That's what it generally means. In hashcat, it's just a reference for how to distribute the workload of the crack job.

The best way is to figure it out is to dive into the code.

https://github.com/hashcat/hashcat-utils/blob/master/src/keyspace.c

I greatly appreciate that, thanks!

It turns out the original password was "bleh" lol.

I figured it out using:

Code 
sudo hashcat -m 3200 hash.txt '/home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt'

sudo hashcat --show -m 3200 hash.txt

I'm never really got into cracking hashes until recently. It was something I overlooked for the most part. I learned more about how databases store passwords as hashes and the importance of cracking said hashes if/when you manage to hack into the server and dump the database. I'm definitely on a mission to learn as much as I can. Its a bit more complex than I realized.

RE: Help cracking passwords with HASHCAT - mutate - Jun 26, 2022

(Jun 26, 2022 09:42 AM)shatter Wrote: You could've used the original command with --show and it would've shown you. (I didn't realize you didn't know how to reveal the job once cracked)

Press the up arrow to reference the command above and append the show flag.

Ahhh, I see. That would be helpful. Thanks again🕵️