8

I own a TrueCrypt container and I can't open it. I remember part of its password. So I want to bruteforce attack on it. I tried many parameters in oclHashCat but none worked (parameter problem). Can someone tell me please; how to pass correct parameters to oclHashCat to bruteforce my password?

Thank you

1
  • That's going to be a long sit ^^ Commented Sep 1, 2016 at 19:49

1 Answer 1

7

This is a good starting point to learn how the Mask Attack from oclHashcat works: https://hashcat.net/wiki/doku.php?id=mask_attack

You need to add the commandline-parameter -a 3 so hashcat knows your going to use a mask attack.

Hashcat comes with some predefined mask's (you can define your own also):

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 - 0xff

Example:

Lets take this as the password you are looking for: PASSWDfA89

You remember the PASSWD part but you didnt remember the other part: fA89

We see that the fA89 part has lowercase and uppercase letters and numbers, then we need this mask: ?l?u?d, but hashcat doesnt have it predefined so we need to use a custom mask.

For this, we need to add another commandline-parameter: -1 [CUSTOM MASK HERE]

The custom mask permits us to create our own charsets (up to 4) but we only need one.

The custom charset should look like this: -1 ?l?u?d

At the end, our command should be something like:

./oclHashcat-plus64.bin -m 6211 test.tc -a 3 -1 ?l?u?d PASSWD?1?1?1?1 -n 32 -u 2000

This is the important part: -a 3 -1 ?l?u?d PASSWD?1?1?1?1

4
  • Output: The manual use of the -n option (or --kernel-accel) is outdated. Please consider using the -w option instead. You can use --force to override this but do not post error reports if you do so. Commented Sep 2, 2016 at 19:44
  • When I replace -n 32 -u 200 with -w 3 that means high profile, this is the error i get: ERROR: clGetPlatformIDs(): CL_UNKNOWN_ERROR Commented Sep 2, 2016 at 19:47
  • 2
    I had opensource nvidia driver. Replaced it with official one and worked for -w 3. Thanks Commented Sep 2, 2016 at 20:02
  • Shouldn't I change 6211? Commented Sep 2, 2016 at 20:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .