0

I'm conducting tests using hashcat and find it very difficult if the hash is encoded.

See the below function which takes the plain text, converts that to the bytes, creates the SHA512 hash and then encode to string.

static string GetSHA512Hash(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return Encoding.UTF8.GetString(hashedBytes);
        }
    }

So the input "P@ssw0rd" (without quotes) would output below with unicode characters:

k??☻k_▬'???♣????gJ?▬?\t"?_?▬?▬0G?z▼BoOLk[PB?q?O?s►?[↑>?Y?'F♦

I cant find a way to crack the above password using hashcat. What Am I missing?

On the other hand, if I just hex convert the bytes of the hash, at least one can attempt cracking it using hashcat.

static string GetSHA512HashAsHex(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return BitConverter.ToString(hashedBytes).Replace("-", "");
        }
    }

So the input "P@ssw0rd" (without quotes) would output below and It can be cracked using hashcat (or at least one can attempt it) 6BFCC4026B5F162799A6DC8305C09DB9C1674AC616BD5C7422A45FBB6D0816AC163047C47A1F426F4F4C6B5B5042C671EABC4FDC7310FD5B183EEF59DC274604

When I try to decode the unicode output above and then hex it, It(obviously) outputs different hex for "P@ssw0rd"

static string GetSHA512HashAsOriginal(string message)
    {
        byte[] hashAsBytes = Encoding.UTF8.GetBytes(message);
        return BitConverter.ToString(hashAsBytes).Replace("-", "");
    }

6BEFBFBDEFBFBD026B5F1627EFBFBDEFBFBDDC8305EFBFBDEFBFBDEFBFBDEFBFBD674AEFBFBD16EFBFBD5C7422EFBFBD5FEFBFBD6D0816EFBFBD163047EFBFBD7A1F426F4F4C6B5B5042EFBFBD71EFBFBD4FEFBFBD7310EFBFBD5B183EEFBFBD59EFBFBD274604

Does it mean Encoding.UTF8.GetString(hashedBytes) (as in the GetSHA512Hash()) would make the cracking process very difficult OR there is a way to do it in this example?

Complete code to test here : https://dotnetfiddle.net/xpQ6lX

Output when "P@ssw0rd" is used as input to hash Complete code in case the dotnetfiddle does not work :

using System;
using System.Security.Cryptography;
using System.Text;
                    
public class Program
{
    public static void Main()
    {
        while (true)
        {
            Console.WriteLine("Enter the plain text password : \n");
            string plainTextPassword = Console.ReadLine();
            string Sha512Hash = GetSHA512Hash(plainTextPassword);
            string Sha512HashAsHex = GetSHA512HashAsHex(plainTextPassword);
            Console.WriteLine("SHA512 hash bytes encoded as string " + Sha512Hash);
            Console.WriteLine("SHA512 hash bytes encoded as Hex " + Sha512HashAsHex);
            Console.WriteLine("SHA512 hash bytes back to original " + GetSHA512HashAsOriginal(Sha512Hash));
        }
    }
    
    static string GetSHA512Hash(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return Encoding.UTF8.GetString(hashedBytes);
        }
    }

    static string GetSHA512HashAsHex(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return BitConverter.ToString(hashedBytes).Replace("-", "");
        }
    }
    static string GetSHA512HashAsOriginal(string message)
    {
        byte[] hashAsBytes = Encoding.UTF8.GetBytes(message);
        return BitConverter.ToString(hashAsBytes).Replace("-", "");
    }
}
schroeder
  • 123,438
  • 55
  • 284
  • 319
  • This is pure programming question and is off topic on Security SE. – mentallurg Jul 10 '22 at 20:04
  • My question was around hashcat and if it could crack password with Unicode characters. The question just has the prep work to show the output of my tests and failures. – Brian Smith Jul 10 '22 at 21:03
  • Actually, you are asking how to feed hashcat unicode strings, or you are asking how to convert unicode strings into a format that hashcat can handle. And your "unicode" example is actually a `byte` example. That's not a problem with "encoding" as you initially state, – schroeder Jul 10 '22 at 21:09
  • 1
    Have you looked at resources like: https://hashcat.net/forum/archive/index.php?thread-6251.html – schroeder Jul 10 '22 at 21:11
  • @schroeder Thank you. Yes. I did look at this. Having hard time how I can use those unicode characters to work with hashcat. Cant see any unicode characters file in the charset folder. – Brian Smith Jul 11 '22 at 13:28

0 Answers0