I have an old truecrypt file that I'd like to decrypt. I know the 18 characters password I was using at the time, I'm sure of it. However I made a "variation" of it : I mapped some characters to l33t equivalent (I know, I know... I was young !).

I wanted to use hashcat to decrypt it, but I'm confused on how to start from the password and generate variations.

In particular, how do I attempt l33t variations for a single char in the password ? For example, U is |_| so 1 char is mapped to 3 char.

I've been reading about masks and such but it's a bit confusing for me. Where should I start ?

Thank you !


There's currently no hashcat-native way to process a list of rules that perform both one-to-one and one-to-multiple character substitutions to attack TrueCrypt at efficient speeds. Because TrueCrypt is a pretty slow hash, you might be better off performing the substitutions using an external program, and then piping the results to hashcat. (In other words, the overhead of generating candidate passwords yourself won't bottleneck the cracking process.)

Your other options using hashcat directly are as follows. They all have trade-offs.

To replace single characters with other single characters, you can use hashcat's built-in rules system - either by making your own rules, or using one of the "leetspeak" rulesets in the "rules/" directory that is distributed with hashcat. To craft some custom rules, you can study the rules system and those rulesets to get the idea.

The attack would look something like:

hashcat -a 0 -m [62xx] -r rules/leetspeak.rule target.hashfile

Replacing a single character with multiple characters -- your 'U' -> '|_|' case -- is a little trickier.

For general purposes, there are options:

  1. Mapping single characters to multiple characters is supported in what is now called hashcat-legacy (CPU only), using what is called a table attack. However, hashcat-legacy does not support Truecrypt hashes, so that won't work for you.

  2. A similar attack is possible in modern hashcat using the -j and -k parameters and what are called positional parameters in the rules system. Basically, you're telling hashcat to "remember" the position that it found a character, removing the character at that position, and then inserting the characters that you want.

The second approach is a special case of selective character substitution, as documented on the hashcat wiki. Here's the relevant part of that documentation, with the multi-character approach mentioned last:

If you only want to operate on the first instance of a character, you can use %1s, or simply use '/':

$ echo -n 'Odessa77' | hashcat --stdout -j '%1s Dp ip$'
$ echo -n 'Odessa77' | hashcat --stdout -j '/s Dp ip$'

If you only want to operate on the second instance:

$ echo -n 'Odessa77' | hashcat --stdout -j '%2s Dp ip$'

… etc. Unlike the 's' rule, which replaces all instances of a character, this allows selection of which instance of a character to replace.

You can also use this functionality to replace one character with multiple characters:

$ echo -n 'p@ssW0rd' | hashcat --stdout -j '%1W DpM ip/ ip\ ip/ ip\'

Notice that the insertion is one character at a time relative to the remembered position, so the characters being inserted are listed in reverse order in the command.

Here's an example closer to your use case:

$ echo TrueCrypt | hashcat --stdout -j '%1u ip| ip_ ip|'

The major drawback of this approach is that positional parameters only work with -j and -k, and so can only be used one at a time (for a single substitution, not part of a large list of substitutions as you are likely to want).

So that's the long story of why rolling your own character substitution method -- with, say, Python, perl, or even sed -- would be the most flexible solution (and because TrueCrypt is such a "slow" hash, generating the strings at super-high speeds isn't necessary).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.