4

I am using hashcat to crack a list of md5 hashes and have used the following command 

hashcat -m 0 -a 0 -o out.txt --force hashdump.txt ../rockyou.txt

which gives the output

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: MD5
Hash.Target......: hashdump.txt
Time.Started.....: Thu Sep 13 01:11:45 2018 (13 secs)
Time.Estimated...: Thu Sep 13 01:11:58 2018 (0 secs)
Guess.Base.......: File (../rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:  1459.2 kH/s (0.55ms)
Recovered........: 2/36 (5.56%) Digests, 0/1 (0.00%) Salts
Progress.........: 14344384/14344384 (100.00%)
Rejected.........: 0/14344384 (0.00%)
Restore.Point....: 14344384/14344384 (100.00%)
Candidates.#1....: $HEX[206b6d3831303838] -> 
    $HEX[042a0337c2a156616d6f732103]
HWMon.Dev.#1.....: N/A

Started: Thu Sep 13 01:11:45 2018
Stopped: Thu Sep 13 01:11:58 2018

It is clear that 2 of the hashes have been found, however the file out.txt isn't created and I have know way of seeing the hash result.

daya
  • 167
  • 2
  • 6
  • 20
Samuel Barkes
  • 41
  • 1
  • 1
  • 2

3 Answers3

7

Hashcat saves its progress in a .pot file. The --show command will let you see the cracked hashes that have been saved in the .pot file.

The FAQ will help with more details.

schroeder
  • 123,438
  • 55
  • 284
  • 319
  • 1
    Would be useful to give also the command which shows them (it's a bit complicated). You have to use actually the same command you used to crack the hash followed by `--show` – DimiDak Jun 14 '21 at 19:24
4

The most probable cause for the -o parameter to fail is if the hashes were cracked in an earlier run. Hashcat will then display the message removed X hashes found in potfile. They will not be displayed in the output and not be saved to the file.

To just view the result you can run the command with the argument --show added.

To save the result in the output file even though they were previously cracked you can disable the "pot-file" (used to store all cracked hashes) temporarily with the argument --potfile-disable added to your command line.

Denis
  • 3,653
  • 2
  • 17
  • 16
-2

Since it doesn't give you an output - for any reason that might be, do it the other way. Assuming you are in linux and have any sort of terminal:

hashcat -m 0 -a 0 --force hashdump.txt ../rockyou.txt >> out.txt

or &>> if you want to include <stderr>. Double > is for text append in a file, or creation of a new one. Single > overwrites or creates a new file.

Same way if you are in windows cmd:

hashcat -m 0 -a 0 --force hashdump.txt ../rockyou.txt > out.txt
Chris Tsiakoulas
  • 1,757
  • 1
  • 9
  • 9
  • This will not work. This will pipe the above output to the file, but that does not include the recovered hash details. – schroeder Sep 13 '18 at 09:24
  • The recovered hash details will be visible in the terminal at the end of the execution anyways, so you won't have the best looking output file, but it will still be an output file which will contain the info you want at the end. – Chris Tsiakoulas Sep 13 '18 at 09:29
  • 1
    Hashcat does not do that by default. Even the OP's output (and the basis for the question) is that 2 hashes were cracked, but there was no output. – schroeder Sep 13 '18 at 09:31