3

I have an old truecrypt file that I'd like to decrypt. I know the 18 characters password I was using at the time, I'm sure of it. However I made a "variation" of it : I mapped some characters to l33t equivalent (I know, I know... I was young !).

I wanted to use hashcat to decrypt it, but I'm confused on how to start from the password and generate variations.

In particular, how do I attempt l33t variations for a single char in the password ? For example, U is |_| so 1 char is mapped to 3 char.

I've been reading about masks and such but it's a bit confusing for me. Where should I start ?

Thank you !

Pak
  • 133
  • 1
  • 5
  • 1
    I don't believe Hashcat supports this. You could try using a script to generate a password list and pass that to hashcat? – Hector Jan 11 '18 at 11:42
  • John has wordlist rules - You may add your own: how-to: http://www.openwall.com/john/doc/RULES.shtml. "Leet" wordlist rules: http://www.openwall.com/lists/john-users/2008/10/03/1 – Mukesh Sai Kumar Jan 11 '18 at 12:05

2 Answers2

3

There's currently no hashcat-native way to process a list of rules that perform both one-to-one and one-to-multiple character substitutions to attack TrueCrypt at efficient speeds. Because TrueCrypt is a pretty slow hash, you might be better off performing the substitutions using an external program, and then piping the results to hashcat. (In other words, the overhead of generating candidate passwords yourself won't bottleneck the cracking process.)

Your other options using hashcat directly are as follows. They all have trade-offs.

To replace single characters with other single characters, you can use hashcat's built-in rules system - either by making your own rules, or using one of the "leetspeak" rulesets in the "rules/" directory that is distributed with hashcat. To craft some custom rules, you can study the rules system and those rulesets to get the idea.

The attack would look something like:

hashcat -a 0 -m [62xx] -r rules/leetspeak.rule target.hashfile

Replacing a single character with multiple characters -- your 'U' -> '|_|' case -- is a little trickier.

For general purposes, there are options:

  1. Mapping single characters to multiple characters is supported in what is now called hashcat-legacy (CPU only), using what is called a table attack. However, hashcat-legacy does not support Truecrypt hashes, so that won't work for you.

  2. A similar attack is possible in modern hashcat using the -j and -k parameters and what are called positional parameters in the rules system. Basically, you're telling hashcat to "remember" the position that it found a character, removing the character at that position, and then inserting the characters that you want.

The second approach is a special case of selective character substitution, as documented on the hashcat wiki. Here's the relevant part of that documentation, with the multi-character approach mentioned last:

If you only want to operate on the first instance of a character, you can use %1s, or simply use '/':

$ echo -n 'Odessa77' | hashcat --stdout -j '%1s Dp ip$'
Ode$sa77
$ echo -n 'Odessa77' | hashcat --stdout -j '/s Dp ip$'
Ode$sa77

If you only want to operate on the second instance:

$ echo -n 'Odessa77' | hashcat --stdout -j '%2s Dp ip$'
Odes$a77

… etc. Unlike the 's' rule, which replaces all instances of a character, this allows selection of which instance of a character to replace.

You can also use this functionality to replace one character with multiple characters:

$ echo -n 'p@ssW0rd' | hashcat --stdout -j '%1W DpM ip/ ip\ ip/ ip\'
p@ss\/\/0rd

Notice that the insertion is one character at a time relative to the remembered position, so the characters being inserted are listed in reverse order in the command.

Here's an example closer to your use case:

$ echo TrueCrypt | hashcat --stdout -j '%1u ip| ip_ ip|'
Tr|_|ueCrypt

The major drawback of this approach is that positional parameters only work with -j and -k, and so can only be used one at a time (for a single substitution, not part of a large list of substitutions as you are likely to want).

So that's the long story of why rolling your own character substitution method -- with, say, Python, perl, or even sed -- would be the most flexible solution (and because TrueCrypt is such a "slow" hash, generating the strings at super-high speeds isn't necessary).

Royce Williams
  • 9,128
  • 1
  • 31
  • 55
0

I guess the best is to generate a list of words with https://github.com/r3nt0n/bopscrk and its powerful leet substitutions and use this list with hashcat.

Pak
  • 133
  • 1
  • 5