0

I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length being too long, and I do not have any idea how to specify custom charsets or lengths. Someone help.


Here is the hash if helpful.

$ml$34129$41de87617daa59bec6ac23618384845f6b799bff8cc2ee5197d1499482fe9bac$c8f0c4a0ab9296c352357fed33cc4a9bccf89d8a3a280f2157c18996957dc1894ec18ec61b2ac0e5ddb7977f85f1d95ce338783817b7feebb062406cd47b89500f35806c47dcbefd0b832890c833d01e9472a5a2d64b46bdae1d265968a983fce15e84d6409ae527992224594d27cd430d24dccac851be60d64c75b1353b7f3c
5

Let me break down, what you want and what the equivalent hashcat options are.

Hash-Type

You want to crack a OSX v10.8+ hash, which according to the hashcat example hashes page (https://hashcat.net/wiki/doku.php?id=example_hashes) is type "7100", so: -m 7100. Specifying the correct hash type should also get rid of the "incorrect length" error.

Attack-Type

You want to do a brute force attack against the hash but not with a dictionary of common words but all possible values. That is hashcat attack mode 3 - a mask attack (https://hashcat.net/wiki/doku.php?id=mask_attack). So you need to specify -a 3.

Characters

The following built-in character sets exist:

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?h = 0123456789abcdef
?H = 0123456789ABCDEF
?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 - 0xff

Your password consists of uppercase letters (?u), lowercase letters (?l) and digits (?d). You can use the built-in hashcat functionality to combine them to a so called custom charset by specifying the charset 1 (-1) as -1?u?l?d. To specify a mask for passwords with up to eight characters, repeat the specifier eight times ?1?1?1?1?1?1?1?1.

Length

You say you password has between six and eight characters. You can tell hashcat to use your all possible combinations from the custom charset that you specified and increment its length up until the length of your mask by using the --increment option (https://hashcat.net/wiki/doku.php?id=mask_attack#password_length_increment). To tell hashcat to start with a mimimum length of 6, use --increment-min 6.

Full Command

That gives the following command:
hashcat -m7100 file_with_hash.txt -a3 -1?l?u?d ?1?1?1?1?1?1?1?1 --increment --increment-min 6

Trying all six-character options on two consumer-grade graphic cards, will take 56 days. All seven and eight character passwords will take significantly longer so you might want to reduce the amount of randomness.

Maybe you know, that the password starts with Mark. The mask would be Mark?1?1?1?1.

Maybe you know it start with an uppercase letter and ends with three digits: ?u?1?1?1?1?d?d?d.

Please see the hashcat wiki and other questions here for more options.

  • this is possibly one of the best, most thorough answers I've ever seen on SE. kudos! – Angelo Schilling Jan 22 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.