[mutate]

So I'm on the website TryHackMe, and I'm doing a practice exercise where I need to crack this hash:

Code

$2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom

Its a BCRYPT hash. I'm using the command statement to crack the hash:

Code

sudo hashcat -m 3200 hash.txt '/home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt'

However, opposed to other hashes I've cracked within the last hour (MD5 and SHA-1) I get this error:

Code

Dictionary cache hit:
* Filename..: /home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt
* Passwords.: 14344384
* Bytes.....: 139921497
* Keyspace..: 14344384

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s

Session..........: hashcat
Status...........: Running
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX...8wsRom
Time.Started.....: Sun Jun 26 01:01:24 2022 (3 secs)
Time.Estimated...: Wed Jun 29 17:08:19 2022 (3 days, 16 hours)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       45 H/s (8.24ms) @ Accel:12 Loops:128 Thr:1 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 144/14344384 (0.00%)
Rejected.........: 0/144 (0.00%)
Restore.Point....: 144/14344384 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:3712-3840
Candidate.Engine.: Device Generator
Candidates.#1....: alejandro -> arsenal
Hardware.Mon.#1..: Temp: 68c Util: 86%

It tells me that I've received a 'cache-hit' which I've never gotten before, and as you can see above I've elected to view the status of the cracking.

It claims its still running. Is this correct? I couldn't find much information online about what a cache-hit was and I didn't know if anyone else has encountered this before.

Thanks!

Edit: When I choose the 'bypass' option, it simply quits hashcat without completing the job.

[mutate]

It's not an error lol, it's just telling you that the data being referenced by hashcat, in this case, the dictionary, is found in memory.

To answer your question, if it claims it is still running, it's still running.

I see, thanks!. Also, what is a keyspace? Apparently, its not the amount of words in your wordlist. At least according to what I read online. I checked hashcat's help documents but didn't really get a finite answer.

[mutate]

It's not the amount of words in the wordlist, it's the amount of possible combinations in your wordlist. That's what it generally means. In hashcat, it's just a reference for how to distribute the workload of the crack job.

The best way is to figure it out is to dive into the code.

https://github.com/hashcat/hashcat-utils...keyspace.c

I greatly appreciate that, thanks!

It turns out the original password was "bleh" lol.

I figured it out using:

Code

sudo hashcat -m 3200 hash.txt '/home/admin/Desktop/Combos, Passes, & Dicts/rockyou.txt'
sudo hashcat --show -m 3200 hash.txt

I'm never really got into cracking hashes until recently. It was something I overlooked for the most part. I learned more about how databases store passwords as hashes and the importance of cracking said hashes if/when you manage to hack into the server and dump the database. I'm definitely on a mission to learn as much as I can. Its a bit more complex than I realized.

[mutate]

You could've used the original command with --show and it would've shown you. (I didn't realize you didn't know how to reveal the job once cracked) 

Press the up arrow to reference the command above and append the show flag.

Ahhh, I see. That would be helpful. Thanks again🕵️