Hashcat Mask Help

Question

I'm wondering on how to run hashcat against wpa2 passwords that are in the following format:

common dictionary word . three digits . common dictionary word

Password Example:

falcon.824.watchman

Is this possible?

Answer 1

These hashcat commands would generate passwords you would like to have:

hashcat64.exe -a 6 dict.txt .?d?d?d. --stdout > stdout.txt
hashcat64.exe -a 1 stdout.txt dict.txt --stdout

The first command would use a Hybrid Dictionary + Mask Attack to generate passwords to the file stdout.txt from your wordlist (dict.txt) combined with a dot, 3 digits and a dot at the end.

The second command would use a Combinator Attack combine generated passwords from stdout.txt to your wordlist again to have the passwords you would like to have.

So to crack WPA2 with your passwords, I would use a command like this:

hashcat64.exe -a 1 -m 2500 hashcat.hccapx stdout.txt dict.txt

Answer 2

As far as I know, plain hashcat does not allow you to do that (there is a workaround though, see below). The closest thing would be a Combinator attack:

hashcat64 -m X -a 1 hash dict.txt dict.txt 

This will combine all words from the two dictionaries (here, the same dictionary is used for both sides). This is nice, but the dots and numbers in between are still missing. They can be added with --rule-left and --rule-right, so if you, for example, knew the number in between was 824, you could do this:

hashcat64 -m X -a 1 --rule-left='$. $8 $2 $4 $.' hash dict.txt dict.txt 

However, there is no way to pass entire rulesets, which is what you would need to try all possible combinations of three digits.

Solution

Luckily, though, you're not the only person to face this problem, so a solution has been developed: comboleetor

Comboleetor allows you to combine wordlists, numbers, and punctuation in a very flexible way to generate large wordlists that you can then either store on disk or pipe to hashcat in dictionary mode (-a 0). Comboleetor options are defined by passing in a specific string via stdin, as well as in two specific files (blocks.txt and numbers.txt).

Comboleetor example (comments in files omitted):

test@test:~/comboleetor$ cat blocks.txt
falcon
watchman

test@test:~/comboleetor$ cat numbers.txt
%03d
840-849

test@test:~/comboleetor$ echo 'BNB' | perl comboleetor.pl
watchman
watchman840
watchman840watchman
watchman840falcon
watchman841
watchman841watchman
watchman841falcon
watchman842
...

This example shows how to generate password candidates based on specific patterns of words and numbers (here, the numbers are formatted to be printed as 3 characters, zero-filled, and the wordlist only consists of falcon and watchman). Now we only need to add the dots in between - unfortunately, there is no way to specify the punctuation characters used by Comboleetor in the same way as one can specifiy the blocks and numbers. Comboleetor will use a wide variety of special characters that are defined in the code itself (comboleeter.pl):

my %punct = (
#  '00sp'  => ' ',
#  '01ex'  => '!',
#  '02dq'  => '"',
#  '03ha'  => '#',
#  '04do'  => '$',
#  '05pc'  => '%',
#  '06am'  => '&',
#  '07sq'  => '\'',
#  '08lp'  => '(',
#  '09rp'  => ')',
#  '10fu'  => '*',
#  '11pl'  => '+',
#  '12cm'  => ',',
#  '13da'  => '-',
  '14pd'  => '.',
#  '15fs'  => '/',
#  '16co'  => ':',
#  '17sc'  => ';',
#  '19la'  => '<',
#  '19eq'  => '=',
#  '20ra'  => '>',
#  '21qu'  => '?',
#  '22at'  => '@',
#  '23rb'  => '[',
#  '24bs'  => '\\',
#  '25lb'  => ']',
#  '26ca'  => '^',
#  '27un'  => '_',
#  '28bt'  => '`',
#  '29lc'  => '{',
#  '30pi'  => '|',
#  '31rc'  => '}',
#  '32ti'  => '~',
  );

The snipped above shows how to comment all punctuation characters except the dot in order to limit our wordlist size as much as possible. After doing this, we can generate our example wordlist by specifying a combination of blocks, punctuation, numbers, punctuation, and blocks:

test@test:~/comboleetor$ echo 'BPNPB' | perl comboleetor.pl     
falcon
falcon.
falcon.840
falcon.840.
falcon.840.falcon
falcon.840.watchman
falcon.841
falcon.841.
falcon.841.falcon
falcon.841.watchman
falcon.842
falcon.842.
falcon.842.falcon
falcon.842.watchman
falcon.843
falcon.843.
falcon.843.falcon
falcon.843.watchman
falcon.844
falcon.844.
falcon.844.falcon
falcon.844.watchman
falcon.845
falcon.845.
falcon.845.falcon
falcon.845.watchman
falcon.846
falcon.846.
falcon.846.falcon
falcon.846.watchman
falcon.847
falcon.847.
falcon.847.falcon
falcon.847.watchman
falcon.848
falcon.848.
falcon.848.falcon
falcon.848.watchman
falcon.849
falcon.849.
falcon.849.falcon
falcon.849.watchman
watchman
watchman.
watchman.840
watchman.840.
watchman.840.falcon
watchman.840.watchman
watchman.841
watchman.841.
watchman.841.falcon
watchman.841.watchman
watchman.842
watchman.842.
watchman.842.falcon
watchman.842.watchman
watchman.843
watchman.843.
watchman.843.falcon
watchman.843.watchman
watchman.844
watchman.844.
watchman.844.falcon
watchman.844.watchman
watchman.845
watchman.845.
watchman.845.falcon
watchman.845.watchman
watchman.846
watchman.846.
watchman.846.falcon
watchman.846.watchman
watchman.847
watchman.847.
watchman.847.falcon
watchman.847.watchman
watchman.848
watchman.848.
watchman.848.falcon
watchman.848.watchman
watchman.849
watchman.849.
watchman.849.falcon
watchman.849.watchman

This wordlist can then be stored on disk or redirected to hashcat. Obviously, when using a real dicitionary and all numbers up to 999, this wordlist will easily become huge, so piping is probably the better idea. Additionally, as you can see, this will generate quite a number of candidates not exactly matching your pattern (e.g., candidates like watchman.849.), but this is the closest I could get to your requirements.