3

Reading the new advice on password which seems to spead easily (at least in my workplace), I was wondering how to use hashcat for cracking four-word password hashes?

Say I have this hash 1da9133ab9dbd11d2937ec8d312e1e2569857059e73cc72df92e670928983ab5 of a password a user claims to be unbreakable because it's a 16 character long "passphrase", how can I combine hashcat's dictionaries to crack it (say I suspect it's a four-word password only)? I see you can combine 2 dictionaries so you can crask 2 words passphrases, but what about 4?

The only way I see so far is creating another dictionary with all combinations of 2 words from the original English dictionary, and then do a combination attack using this "2words" dictionary twice (so it makes it a four-word dictionary):

./combinator.bin dict.txt dict.tdt > dict2words.txt
./hashcat64.bin -m 0 -a 1 hash.txt dict2words.txt dict2words.txt

But it feels heavy to generate such a dict2words.txt file.

Improve this question

1 Answer 1

Reset to default
3

You're looking for hashcat's related tool princeprocessor, also by hashcat's author. It's specifically designed for multiword passphrases and similar "combination" work.

A killer PRINCE feature is that it does all of the combination work for you without having to store all combinations on disk (which is probably what you meant by "heavy"?)

princeprocessor also includes some hashcat rules that are designed to maximize GPU utilization by adding a variety of permutations.

Tip: tinker with very short wordlists and observe the output directly:

$ cat wordlist.txt
xenos
hashcat
prince
passphrase

$ pp64 --elem-cnt-min=4 --elem-cnt-max=4 wordlist.txt
xenosxenosxenosxenos
xenosxenosxenosprince
xenosxenosprincexenos
xenosprincexenosxenos
princexenosxenosxenos
xenosxenosxenoshashcat
xenosxenosprinceprince
xenosprincexenosprince

[...]
passphraseprincehashcatxenos
passphrasehashcatxenosxenos
hashcatpassphraseprincexenos
passphrasehashcatprincexenos

... and then once it's working the way you expect, pipe your output to hashcat using wordlist mode (-a 0) with your real wordlist.

Improve this answer
2
  • 1
    It's indeed what I was looking for. I only didn't think that the pipe attack was so slow (pp64 ... | hashcat64= 5MH/s while hashcat -a 1 -m 1400 ... dico.txt dico.txt = 380MH/s) I suppose I loose a lot of parallelization when using pipe?
    – Xenos
    Jul 29, 2019 at 15:30
  • Yep - you can do more "work" by supplying rules - but if it's a straight wordlist and you know the wordlist, the case, etc. then rules won't help much. Though for short wordlists, you can also generate a ruleset which basically simulates adding another word to the end, which could speed things up quite a bit.
    – Royce Williams
    Jul 29, 2019 at 20:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .