5

I own a TrueCrypt container and I can't open it. I remember part of its password. So I want to bruteforce attack on it. I tried many parameters in oclHashCat but none worked (parameter problem). Can someone tell me please; how to pass correct parameters to oclHashCat to bruteforce my password?

Thank you

  • That's going to be a long sit ^^ – Yorick de Wid Sep 1 '16 at 19:49
5

This is a good starting point to learn how the Mask Attack from oclHashcat works: https://hashcat.net/wiki/doku.php?id=mask_attack

You need to add the commandline-parameter -a 3 so hashcat knows your going to use a mask attack.

Hashcat comes with some predefined mask's (you can define your own also):

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 - 0xff

Example:

Lets take this as the password you are looking for: PASSWDfA89

You remember the PASSWD part but you didnt remember the other part: fA89

We see that the fA89 part has lowercase and uppercase letters and numbers, then we need this mask: ?l?u?d, but hashcat doesnt have it predefined so we need to use a custom mask.

For this, we need to add another commandline-parameter: -1 [CUSTOM MASK HERE]

The custom mask permits us to create our own charsets (up to 4) but we only need one.

The custom charset should look like this: -1 ?l?u?d

At the end, our command should be something like:

./oclHashcat-plus64.bin -m 6211 test.tc -a 3 -1 ?l?u?d PASSWD?1?1?1?1 -n 32 -u 2000

This is the important part: -a 3 -1 ?l?u?d PASSWD?1?1?1?1

  • Output: The manual use of the -n option (or --kernel-accel) is outdated. Please consider using the -w option instead. You can use --force to override this but do not post error reports if you do so. – Mustafa Chelik Sep 2 '16 at 19:44
  • When I replace -n 32 -u 200 with -w 3 that means high profile, this is the error i get: ERROR: clGetPlatformIDs(): CL_UNKNOWN_ERROR – Mustafa Chelik Sep 2 '16 at 19:47
  • 2
    I had opensource nvidia driver. Replaced it with official one and worked for -w 3. Thanks – Mustafa Chelik Sep 2 '16 at 20:02
  • Shouldn't I change 6211? – Mustafa Chelik Sep 2 '16 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.