hashcat Forum

Hi there
I have few questions regarding etherum wallet. created test one with password: Password!

{"version":3,"id":"a9abfd0e-acd6-4f61-b94a-4e6218e3b545","address":"1b683d03d29ff1d5d5d4bab15b8ec1c686a04917","Crypto":{"ciphertext":"c8d2df24d8d41ae4ef5f94d446e42adeacb112e0c7c69bfd0548b277c999ee8d","cipherparams":{"iv":"06c00f278dbae15c7d70b6e7a2860701"},"cipher":"aes-128-ctr","kdf":"scrypt","kdfparams":{"dklen":32,"salt":"f6be6c9c0fbeeacc45f2ed5ade94cee9374a05e964988a5ff51434a3c7759c6a","n":1024,"r":8,"p":1},"mac":"e520ba417017fbaf6bedb529411aead55bd80f51e021b4db846950f92d0cec61"}}

and from that extracted hash with ethereum2john.py which use formula below

$ethereum$s*n*r*p*salt*ciphertext*mac

$ethereum$s*1024*8*1*f6be6c9c0fbeeacc45f2ed5ade94cee9374a05e964988a5ff51434a3c7759c6a*c8d2df24d8d41ae4ef5f94d446e42adeacb112e0c7c69bfd0548b277c999ee8d*e520ba417017fbaf6bedb529411aead55bd80f51e021b4db846950f92d0cec61

but this formula doesnt work with hashcat 4.0 (no hash loaded), but the other formula

$ethereum$s*n*r*p*salt*mac*ciphertext

works fine, but the hashcat cant find password which is in dictionary, tried:

C:\aa\Hashcat4.0>hashcat32.exe -m 15700 -a 0 -D 1 testwallet1.txt tempdic.txt
C:\aa\Hashcat4.0>hashcat32.exe -m 15700 -D 1 testwallet1.txt tempdic.txt
C:\aa\Hashcat4.0>hashcat32.exe -m 15700 -o recovered.txt -D 1 testwallet1.txt tempdic.txt

Dictionary cache hit:
* Filename..: tempdic.txt
* Passwords.: 13
* Bytes.....: 50
* Keyspace..: 13

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: Ethereum Wallet, SCRYPT
Hash.Target......: $ethereum$s*1024*8*1*f6be6c9c0fbeeacc45f2ed5ade94ce...99ee8d
Time.Started.....: Thu Dec 07 12:18:37 2017 (0 secs)
 Time.Estimated...: Thu Dec 07 12:18:37 2017 (0 secs)
 Guess.Base.......: File (tempdic.txt)
 Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#2.....:        0 H/s (2.85ms)
 Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 13/13 (100.00%)
Rejected.........: 0/13 (0.00%)
Restore.Point....: 13/13 (100.00%)
Candidates.#2....: z -> 
HWMon.Dev.#2.....: N/A

This wallet (original myethwallet file) and dictionary were tested with ethcracker and password was found.
Any ideas why this doesnt work?

The hash in your example, ending in "61", seems to work just fine. Cracked immediately with hashcat.

(12-07-2017, 05:45 PM)Chick3nman Wrote: [ -> ]The hash in your example, ending in "61", seems to work just fine. Cracked immediately with hashcat.

Hi there, thanks for confirmation. My hashcat was corrupted, I just downloaded another copy and everythong is ok.

thanks again