hashcat Forum

(01-28-2020, 03:58 PM)msalman Wrote: [ -> ]the pass is in my first wordlist
11223344

The attached hccapx file is a multi hash file. It contain 15 hashes (6 of them are dupes). If one of them is not recovered, hashcat will exhaust!
only 4 of 9 are recoverable running hashcat default options.

But all of them are recoverable by activating nonce-error-corrections:

Which tool did you use to capture the traffic?
Which tool did you use to convert the handshakes?
Can you please attach the cap file?

i have used ka li and air o dump and then i have used hashcat online converter but i only capture one bssid then why it have multi hashes i dont understand!!
should i use this --nonce-error-corrections=128 in my batch ?
cap link
https://gofile.io/?c=OKhbbD

hashcat online converter run cap2hccapx from hashcat-utils.
You should know that cap2hccapx will convert more than one hash to the hccapx file. Therefore it takes every good message pair and convert it:


Result is a single hccapx file that contain 15 hashes from your BSSID!

I noticed that you ran airodump-ng in combination with aireplay-ng to deauthenticate the client. In that case you must expect a packet loss, because neither aireplay-ng (active part) nor airodump-ng (passive part) request missing packets. Additional your cap file contain many, many useless frames.
Also, you have made much noise on the channel to get a few hashes:
DEAUTHENTICATION (total).................: 10779 !!!!!!!!!!!!!


Using the new hashline (hashmode -m 22000), you will get three PMKIDs and one EAPOL messagepair :
EAPOL pairs written to combi hash file...: 1 (RC checked)
PMKID (best).............................: 3


If you take a closer look at the converted hashes, you'll notice that hcacpangtool converted different "best" hashes (a PMKID send from the access point to every CLIENTS and an EAPOL messagepair).
Running hashcat against them will recover the PSK quickly (and without any additional options):

Three times from the PMKID and one time from the EAPOL messagepair.

BTW:
You may have noticed that the new hashline is HEX-ASCII. You can use simple bash commands to show it, to sort it and to remove unwanted hashes.
A single PMKID is more than enough to recover the PSK. You can remove the other hashes.

should I use this --nonce-error-corrections=128 in my batch ?
-> that question isn't easy to answer, because it depend on the tools you use to atttack the network, to capture the traffic, to convert the hash and to recover the PSK.
But hcxpcangtool will help you a little bit to choose the nonce-error-corrections values. This is the measured value between the lowest replaycount and the highest replaycount:
REPLAYCOUNT gap (measured maximum).......: 23
Always, you can use this value for hashcat nonce-error-corrections to be on the safe side.
Running hcxdumptool to attack and capture, hcxpcapngtool to convert and latest hashcat to recover the PSKs will give you good results and less noise on the channel (PMKID attack: https://hashcat.net/forum/thread-7717.html).
If you have a PMKID, use it (hashcat old hashmode -m 16800 or hashcat new hashmode -m 22000). Don't waste your GPU time on EAPOL messagepairs (unless you like to discover the secrets of an unauthorized M2).
If you retrieve the PMKID by hand (Wireshark), keep in mind that it can be calculated using a zeroed PMK!
If you run hcxpcapngtool, you will be informed and this kind of PMKID will not be not converted:
PMKID (over zeroed PMK)..................: 1

Additional hcxhashtool will give you an information about the ACCESS POINT, the CLIENT and the state of the authentication:

And even if you decide to convert all(!) hashes, your attempt will be successful:

By option --all, hcxpcapngtool will convert all PMKIDs and all EAPOL messagepairs. That included many duplicates, but hashcat recovered the PSKs successful from them, too.

In that case you should use at least nonce-error-corrections=8 to recover all PSKs.

is there any script for The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) linux which can automate hcxdumptool capture and hcxpcapngtool convert process

No, you have to code it by yourself. It is very simple:
https://github.com/ZerBea/hcxtools/issue...-581013958

One last question: Which options have you used to capture the dumpfile?

I noticed that all(!) undirected proberequest frames are not present (filtered out).
This frames may contain information about PSKs. So it is definitely not a good idea to remove them from your cap file!


BTW:
Again, thanks for the cap file. It reminded me to add several warnings (hcxpcapngtool), to inform about missing frames, zeroed timestamps, broken timestamps, bit errors (PLCP errors).