Hashcat separator unmatched ошибка

PS F:hashcat-6.2.4> hashcat -m 22000 capture1.hccapx wordlist.txt
hashcat (v6.2.4) starting

Successfully initialized NVIDIA CUDA library.


* Device #1: CUDA SDK Toolkit not installed or incorrectly installed.
             CUDA SDK Toolkit required for proper device support and utilization.
             Falling back to OpenCL runtime.

* Device #1: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
nvmlDeviceGetFanSpeed(): Not Supported

OpenCL API (OpenCL 3.0 CUDA 11.4.125) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #1: NVIDIA GeForce GTX 1660 Ti, 5376/6144 MB (1536 MB allocatable), 24MCU

OpenCL API (OpenCL 2.1 ) - Platform #2 [Intel(R) Corporation]
=============================================================
* Device #2: Intel(R) UHD Graphics 630, 1568/3214 MB (803 MB allocatable), 24MCU

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63

Hashfile 'capture1.hccapx' on line 1 (HCPX♦): Separator unmatched
Hashfile 'capture1.hccapx' on line 2 ("·↑úæF┬m▒∟#◄∟ å/╧èû∞$): Separator unmatched
Hashfile 'capture1.hccapx' on line 3 (): Separator unmatched
No hashes loaded.

Started: Mon Sep 06 12:42:23 2021
Stopped: Mon Sep 06 12:42:24 2021

D

There is no way to get the original string from the hash. To understand the reason, let’s see how the hash works.Second https://docs.python.org/3/library/functions.html#hash , hash receives an object (any one, not only strings) and returns a number.As there are more possible objects than numbers, there will always be multiple objects (be strings, be any other things) whose hashe values are equal. Example (producing the Python interpreter on my machine):>>> hash(‘a’)
1844645535655954614
>>> hash(1844645535655954614)
1844645535655954614
Obs: The numbers will be different if you run on your machine, more about it at the end of the answer.In the case, we have a string and a number that produce the same value of the hash (I «wrote» a bit passing a number in the second call because I was lazy to look for two different strings that generated the same hash).You could still have a class that returns that same value:class Test:
def __hash__(self):
return 1844645535655954614
print(hash(Test())) # 1844645535655954614
The above code is not a useful implementation, it is only to show that there can be a class that returns the same hash as a string.Therefore, when having only the value of the hash, it is not possible to know whether it came from a string, from a number, or from any other class. The hash is not a reversible value. Even two different strings can generate the same hash (the difficulty of finding them depends on the algorithm, of course).Do not use this for encryptionSecond https://docs.python.org/3/reference/datamodel.html#object.hash , when calling hash(objeto), internally a call is made to objeto.hash(). And about strings, it is worth highlighting this excerpt:By default, the hash() values of str and bytes objects are “salted” with an unpredictable random value. Although they remain constant within an individual Python process, they are not predictable between repeated invocations of Python.This is intended to provide protection against a denial-of-service caused by carefully-chosen inputs that exploit the worst case performance of a dict insertion, O(n^2) complexity. See http://www.ocert.org/advisories/ocert-2011-003.html for details.In free translation:By default, for objects str and bytes, added a Jump random to value hash(). Although this remains constant throughout a Python process, the values are not predictable between repeated Python invocations.This is intentional, to protect against denial of service attacks caused by well-chosen entries that explore the worst case of insertion performance in dictionaries, which is O(n^2). See http://www.ocert.org/advisories/ocert-2011-003.html for more details.About the concept Jump, I suggest https://pt.stackoverflow.com/q/2402/112052 So I said the value of hash(‘a’) that you will get will not necessarily be the same as I got above. Each Python invocation is generated Jump random which is used in hash calculation, and the results will be different. This is not a problem for function purpose hashsince the documentation says that «They are used to quickly compare dictionary keys during a dictionary lookup» (they are used to compare keys to a dictionary during a key search). In this case, collisions (different objects that have the same hash value) are not necessarily a problem (since they are not so frequent) — read more about the subject https://pt.stackoverflow.com/a/27915/112052 .Anyway, as the value of hash(objeto) can vary with each Python execution, it is not a good to use it to the hash of a password, as suggested by https://pt.stackoverflow.com/a/432113/112052 .Let’s assume that first the user registered the password and you saved the hash:hash_senha = hash(senha_que_usuario_cadastrou)
gravar hash_senha
A time later the user enters the password and you compare her hash with what was previously recorded:# obter o hash da senha gravada no passo anterior
hash_senha = …
comparar com o hash da senha que o usuário digitou
if hash_senha == hash(senha_digitada):
# senha ok
But as the value of hash may vary (as explained above), the if above does not guarantee that the hashes will be equal, even if the password is correct (a simple restart on the server, for example, will already cause Jump used be another and the user will no longer log. Or you can give the immense misfortune of a different password to generate a hash equal to that which was recorded in the first step (this is most unlikely, but it is not impossible).If you want to save password hashes, I suggest using the https://docs.python.org/3/library/hashlib.html , which in addition to ensuring that the same string always generates the same hash, still has more suitable algorithms for this purpose (I will not go into more details because I think it already escapes from the scope of the question). Finally, if you want something that is reversible, then you don’t want hash algorithms, and yes https://www.google.com/search?q=encryption+algorithms+in+python .

Why are there a series of technical challenges behind “OMG buy it”>>>

Working environment: Ubuntu 16.04, NVIDIA graphics card gtx750ti, driver and CUDA have been installed

Recently, when a RAR compressed package was encrypted, it forgot its password and crashed. Fortunately, there is no way out. I searched the Internet for rar files like this, which are encrypted even the file list. It’s relatively difficult to decrypt them. If the file list is not encrypted (that is, you can see the file list when you open it, but you need a password to decompress it, if you want to decrypt this kind of file, you don’t need to look down ), this kind of encrypted rar file is troublesome to decrypt, because you can only write the check code to try to decompress and then compare the file. Fortunately, at that time, for the sake of “safety”, people chose not to see the file list

HashCat

https://github.com/hashcat/hashcat.git

The compilation guidance document is in build.md, and it’s easy to make and compile. After compiling, there will be an executable program of hashcat in the current source code directory

JohnTheRipper

https://github.com/magnumripper/JohnTheRipper.git

Ubuntu16 actually comes with John, but it doesn’t seem to come with rar2john, so I have to compile it myself. In fact, Jhon itself is also a password decryption tool, but here we only use rar2john to extract the encrypted hash of RAR. The compiled guidance document is in Doc/install-ubuntu. The actual compilation is also very smooth. After entering the SRC directory configure, make is OK, just like many open source software. Then you can find rar2john in the run directory

Then I use the RAR command to prepare a test file rar a – HP file.rar test.txt, and input 123 as the password to test the performance of hashcat

Then I use John to extract the encrypted hash of the rar file

rar2john file.rar
file.rar:$RAR3$*0*a64766df3a5c3bc9*0e875d8103a381d7f81a03121c693ef4:0::::file.rar

So far, everything is going well. But when I use hashcat to decrypt, something goes wrong

hashcat -m 12500 -a 3 $RAR3$*0*a64766df3a5c3bc9*0e875d8103a381d7f81a03121c693ef4 ?d?d?d -o out.txt
hashcat (v5.1.0-1671-g1de0857+) starting…

* Device #1: WARNING! Kernel exec timeout is not disabled.
This may cause “CL_ OUT_ OF_ RESOURCES” or related errors.
To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #2: WARNING! Kernel exec timeout is not disabled.
This may cause “CL_ OUT_ OF_ RESOURCES” or related errors.
To disable the timeout, see: https://hashcat.net/q/timeoutpatch
CUDA API (CUDA 9.0)
===================
* Device #1: GeForce GTX 750 Ti, 1554/1992 MB, 5MCU

OpenCL API (OpenCL 1.2 CUDA 9.0.368) – Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #2: GeForce GTX 750 Ti, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hash ‘0*a64766df3a5c3bc9*0e875d8103a381d7f81a03121c693ef4’: Separator unmatched

Yeah?Separator unmatched？

I suspect that the parameter I input is wrong?Theoretically, 12500 corresponds to rar encryption hash. See the official wiki of hashcat

https://hashcat.net/wiki/doku.php?id=example_ hashes
12500 RAR3-hp $RAR3$*0*45109af8ab5f297a*adbf6c5385d7a40373e8f77d7b89d317

I input the example given by the official wiki into my compiled hashcat for decryption, and also report “separator unmatched”. I’m speechless, because according to my experience, hashcat, a mature open source project, won’t have too many problems, unless I’m lucky enough to memorize clone. The latest code is not stable, and it’s more likely that I didn’t find any low-level mistakes in my operation

But after trying several parameter combinations, I still can’t find out the reason. I can only debug hashcat. Hashcat is a C code project. GDB is the first choice for debugging in Linux environment. The executable program I compiled does not have debugging information, so I need to add the – G option when compiling GCC. Originally, I thought that modifying makefile would be a troublesome process. After a simple analysis, I found that makefile supports generating code with debugging information, so I don’t need to modify it by myself. The method is to change debug: = 0 at the beginning of makefile file to debug: = 1

The source code structure of hashcat itself is relatively clear, and it is easy to find the code corresponding to 12500 mode in Src/modules/module_ 12500.c。 The function responsible for parsing is module_ hash_ decode。 However, after some breakpoint debugging, I still don’t quite understand the cause of the error. It seems that a * separator is missing. Until I noticed the hash string passed in:

#0 module_ hash_ decode (hashconfig=0x711360, digest_ buf=0x93a0a0, salt=0x8e45d0, esalt_ buf=0x0,
hook_ salt_ buf=0x0, hash_ info=0x0,
line_ buf=0x7fffffffdf8e “0*45109af8ab5f297a*adbf6c5385d7a40373e8f77d7b89d317*”, line_ len=52)
at src/modules/module_ 12500.c:115

It turns out that the debugging direction I started with was wrong. The line passed in when I called the function_ The content of buf itself is incomplete. Where is the head “$rar3 $”?Or is this normal?So I changed the direction and started to analyze from the outside. I broke the breakpoint directly on the main function and found a problem

(gdb) p argv[3]
$29 = 0x7fffffffdf8e “0*45109af8ab5f297a*adbf6c5385d7a40373e8f77d7b89d317*”

It turns out that there was something wrong with the parameters I passed in… The operation was as fierce as a tiger, and I finally found myself in the middle of the two hundred and five

So, what caused me to enter the program with complete parameter input and the head “$rar3 $” was eaten?I immediately thought of the reason: the information I’m looking for is operated under windows, while under the command line of Linux, $is a special character

I test

Echo “$rar3 $* 0 *”
output results

0*

Echo “ $rar3 $* 0 *”
output results

$RAR3$*0*

So the final solution is obvious. Just add a “” escape, similar to

hashcat -m 12500 -a 3 $RAR3$*0*58c34e824da2ba03*1e760c511a8c6498e32f9514d2ef6764 ?d?d?d?d?d?d -o out.txt

Hashcat in my machine configuration can try an encrypted hash combination of 5K RARs in a second. If it is a pure digital password of 0-9, 3 bits is the third power of 10, and 10 bits is the tenth power of 10. When it comes to such a long number of digits, according to my environment, the decryption speed of 10 ^ 10/5000/60/60/24 in the worst case also needs 20 days

MacBook:~ apple$ `hashcat -m 22000 capture.hccapx wordlist.txt`
hashcat (v6.2.5) starting

wordlist.txt: No such file or directory

Started: Thu *** ** 14:36:23 ****
Stopped: Thu ** ** 14:36:23 ****

MacBook:~ apple$ `hashcat -m 22000 -a3 capture.hccapx "?d?d?d?d?d?d?d?d`
hashcat (v6.2.5) starting

* Device #2: This device's local mem size is too small.

OpenCL API (OpenCL 1.2 (May  7 2020 00:10:14)) - Platform #1 [Apple]
====================================================================
* Device #1: Intel(R) Core(TM)2 Duo CPU     P8600  @ 2.40GHz, 2016/4096 MB (512 MB allocatable), 2MCU
* Device #2: GeForce 320M, skipped

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63

Hashfile 'capture.hccapx' on line 1 (HCPX): Separator unmatched

Hashfile 'capture.hccapx' on line 2 (): Separator unmatched

Hashfile 'capture.hccapx' on line 3 (): Separator unmatched

Hashfile 'capture.hccapx' on line 4 (): Separator unmatched

Hashfile 'capture.hccapx' on line 5 (): Separator unmatched

Hashfile 'capture.hccapx' on line 6 (????l?"?:9M†N??~Ry): Separator unmatched

Hashfile 'capture.hccapx' on line 7 (): Separator unmatched

Hashfile 'capture.hccapx' on line 8 (????l?"?:9M†N??~R): Separator unmatched

Hashfile 'capture.hccapx' on line 9 (????l?"?:9M†N??~Ry): Separator unmatched

Hashfile 'capture.hccapx' on line 10 (): Separator unmatched

Hashfile 'capture.hccapx' on line 11 (????l?"?:9M†N??~R): Separator unmatched

Hashfile 'capture.hccapx' on line 12 (): Separator unmatched

Hashfile 'capture.hccapx' on line 13 (): Separator unmatched

Hashfile 'capture.hccapx' on line 14 (??my): Separator unmatched

Hashfile 'capture.hccapx' on line 15 (): Separator unmatched

Hashfile 'capture.hccapx' on line 16 (??m): Separator unmatched

Hashfile 'capture.hccapx' on line 17 (??my): Separator unmatched

Hashfile capture.hccapx on line 18 (): Separator unmatched

Hashfile capture.hccapx on line 19 (??m): Separator unmatched

No hashes loaded.

Started: Thu *** ** 14:36:39 ****
Stopped: Thu *** ** 14:36:40 ****

1 ответ