12x GPU Monster For SALE by HashKiller Owner

NOTE: Why not use our List Manager to crack your lists? Its easy and enables better management.

NOTE: When cracking WPA/WPA2 passwords, make sure you check gpuhash.me first incase it's already been processed.

Home - (Archived) Hash-Cracking Requests - Help to understand to crack SHA-512


17 Results - Page 1 of 1 -
1
Author Message
Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 11:50:37

Please help to understand how to crack the following.

Protection algorithm: SHA-512
Hash: "q+EaXkOf9EAQxJtIAfDU+m/1jjdZQaPvJUr3yOWgLz2x9gIhXSWyD+d0p05M0laaH9VEVCKJ31dO1La1u4saDw=="
Salt: "ukuH7+yW+WJC4Nb0D7/toA=="

How do I crack this with hashcat using wordlist? No need to crack it for me.


Avatar
Szul

Status: Elite
Joined: Sat, 15 Sep 2012
Posts: 1558
Team:
Reputation: 1452 Reputation
Offline
Thu, 28 Jun 2018 @ 11:53:17

First You should convert base64 format of hash to "normal" one, later feed abe11a5e439ff44010c49b4801f0d4fa6ff58e375941a3ef254af7c8e5a02f3db1f602215d25b20fe774a74e4cd2569a1fd544542289df574ed4b6b5bb8b1a0f string to hashcat and try crack it


Jabber: Szul@jabb.im
4 x GTX 1080
TEAM HASHCAT

Avatar
andydis

Status: Cracker
Joined: Thu, 13 Apr 2017
Posts: 76
Team: www.hashcat.online
Reputation: 48 Reputation
Offline
Thu, 28 Jun 2018 @ 11:56:38

N.B. : the converter can be found here https://www.hashkiller.co.uk/bin-translator.aspx


Avatar
Mexx666666
Moderator
Status: Elite
Joined: Fri, 21 Jul 2017
Posts: 1190
Team:
Reputation: 3104 Reputation
Online
Thu, 28 Jun 2018 @ 11:59:44

abe11a5e439ff44010c49b4801f0d4fa6ff58e375941a3ef254af7c8e5a02f3db1f602215d25b20fe774a74e4cd2569a1fd544542289df574ed4b6b5bb8b1a0f:ba4b87efec96f96242e0d6f40fbfeda0

Maybe hashcat mode 1760 ( HMAC-SHA512 (key = $salt) )


PLZ +rep if I helped out!

BTC: 1FxAJJhcqf2DXt[remove]PkdTQi56uc3EGxYQjG4T
PP: mexx66[remove]@gmx.net
Discord: Mexx666666#2361 for PRIVATE & confidential quality hash cracking @ reasonable compensation (email hashes, ALL hashtypes in general)

Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 12:01:39

What do I do with salt? what will be end format for the hash?


Avatar
Szul

Status: Elite
Joined: Sat, 15 Sep 2012
Posts: 1558
Team:
Reputation: 1452 Reputation
Offline
Thu, 28 Jun 2018 @ 12:02:53

without acces to source code OR have valid hash:plain pair is hard to tell
it can be sha salt.pass / pass.salt / or simple sha512 without salt involved


Jabber: Szul@jabb.im
4 x GTX 1080
TEAM HASHCAT

Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 12:10:29

It protected excel file. office2john.bin didn't work to created hash file, thus I managed to get hash of xml file. Don't know excel version.


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 12:12:11

Possibly round 2006-2007.


Avatar
Szul

Status: Elite
Joined: Sat, 15 Sep 2012
Posts: 1558
Team:
Reputation: 1452 Reputation
Offline
Thu, 28 Jun 2018 @ 12:13:46

hmm office2john output looks like
$office$*2007*20*128*16*88957a....................
if You can plz post file here, we can try extract hash for You


Jabber: Szul@jabb.im
4 x GTX 1080
TEAM HASHCAT

Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 12:17:33

I cannot post file, there is confidential info.


Avatar
andydis

Status: Cracker
Joined: Thu, 13 Apr 2017
Posts: 76
Team: www.hashcat.online
Reputation: 48 Reputation
Offline
Thu, 28 Jun 2018 @ 12:18:06

If you opened the .xlsx with A ZIP Program and got the hash from the encoded XML file
There is a way to delete the password and unprotect the document as opposed to recover the password.

Look for the code workbookProtection workbookPassword="93AF" lockStructure="1" lockWindows="1"

and delete all the code from open bracket workbookProtection to whever the close bracket is


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 12:22:08

andydis said:

If you opened the .xlsx with A ZIP Program and got the hash from the encoded XML file
There is a way to delete the password and unprotect the document as opposed to recover the password.

Look for the code workbookProtection workbookPassword="93AF" lockStructure="1" lockWindows="1"

and delete all the code from open bracket workbookProtection to whever the close bracket is

Thanks for advice, I was thinking about this method, but thought would be nicer to attack the hash as I got it.


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 12:22:53

Mexx666666 said:

abe11a5e439ff44010c49b4801f0d4fa6ff58e375941a3ef254af7c8e5a02f3db1f602215d25b20fe774a74e4cd2569a1fd544542289df574ed4b6b5bb8b1a0f:ba4b87efec96f96242e0d6f40fbfeda0

Maybe hashcat mode 1760 ( HMAC-SHA512 (key = $salt) )

How did you worked out 1760?


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 14:22:06

kangaroot said:

andydis said:

If you opened the .xlsx with A ZIP Program and got the hash from the encoded XML file
There is a way to delete the password and unprotect the document as opposed to recover the password.

Look for the code workbookProtection workbookPassword="93AF" lockStructure="1" lockWindows="1"

and delete all the code from open bracket workbookProtection to whever the close bracket is

Thanks for advice, I was thinking about this method, but thought would be nicer to attack the hash as I got it.

It is not workbook protected, it is individual sheet protection and there is no such parameters you've mentioned above. Anyway, as we are on hash killer site, I'd rather find solution on how to crack it than turn protection off.


Avatar
Szul

Status: Elite
Joined: Sat, 15 Sep 2012
Posts: 1558
Team:
Reputation: 1452 Reputation
Offline
Thu, 28 Jun 2018 @ 14:23:58

if it is protected office file just run office2john to extract hash. I dont know what else i can tell
If got some errors with this scrypt plz search answers in pyton


Jabber: Szul@jabb.im
4 x GTX 1080
TEAM HASHCAT

Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 14:48:45

Szul said:

if it is protected office file just run office2john to extract hash. I dont know what else i can tell
If got some errors with this scrypt plz search answers in pyton

Script returns "zip container found, file is unencrypted?, invalid OLE file!".


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 28 Jun 2018 @ 15:09:07

Just so you know, the password can be removed by deleting the entire protection node in an OpenXML file, but that doesn't help to understand the principle of how it was protected.



17 Results - Page 1 of 1 -
1

We have a total of 202048 messages in 24898 topics.
We have a total of 22203 registered users.
Our newest registered member is shadowhz.