[deprecated] oclHashcat-lite

Note: all versions of oclHashcat have been replaced by a unified OpenCL CPU/GPU version, now known simply as hashcat.

oclHashcat-lite is a GPGPU cracker that is optimized for cracking performance. Therefore, it is limited to only doing single-hash cracking using Markov attack, Brute-Force attack and Mask attack.

Note: Please use oclHashcat instead, lite is deprecated.

Last Version was 0.15 before it was replaced by oclHashcat.

The real reason behind the development of oclHashcat-lite was that too many people compared apples to oranges. Back in the days when there was only oclHashcat and oclHashcat-plus people compared them against pure single-hash and brute-force-only crackers such as IGHASHGPU, whitepixel or BarsWF. They took the “cracking performance” as the most important factor for comparison.

The “cracking performance” itself is not the most important factor in cracking passwords. The most important factor is how fast it can crack a password. A big difference, and one that oclHashcat and oclHashcat-plus focused on. The best “cracking performance” however can only be achieved only by using both the pure single-hash and brute-force attack vectors.

To compare which program can crack a specific hash the fastest produces results that are too abstract to be put into any kind of comparison. There are many variables that influence the results. That's why people continued to compare using the simple “cracking performance”. In other words, there was a need for a special hashcat version that is optimized for “cracking performance”.

The first version was a special oclHashcat version called v0.26 beta. With this version oclHashcat came to the world's fastest MD5 single hash cracker. Before that, it was (in reverse-order): whitepixel, IGHASHGPU, BarsWF. This created a lot of attention, but to make it a real and useable program a re-write was required. This new program was called: oclHashcat-lite.

Initially it was a disaster. Some guy came into the #hashcat IRC channel and said he wanted to help with development and do beta-testing. That's nothing special. Usually people get access to early beta versions this way. They are then doing tests, reporting on speed, checking if it cracks everything it should, etc. But at the same time people from SL3 scene became interested in oclHashcat-lite. That was because cracking SL3 basically means cracking SHA1. And with oclHashcat-lite we also had world's fastest SHA1 cracker. After a while it turned out that this guy who “just wanted to help” actually started selling the oclHashcat-lite beta in the SL3 scene.

The first official release was v0.02, released on 10.04.2011.

Another important release was v0.04, released on 30.04.2011: It was the first hashcat version that supported the “descrypt” aka “DES(Unix)” aka “Traditional DES” algorithm.

In the meantime, some review sites like ht4u.net started to use oclHashcat-lite as a reference for their GPGPU tests.

With the v0.10 release on 29.06.2012 oclHashcat-lite was the first program of the hashcat family that supports Markov Attack.

oclHashcat-lite, advanced password recovery

Usage: oclHashcat-lite [options]... hash [mask]

=======
Options
=======

* General:

  -m,  --hash-type=NUM               Hash-type, see references below
  -V,  --version                     Print version
  -h,  --help                        Print help
       --eula                        Print EULA
       --quiet                       Suppress output

* Benchmark:

  -b,  --benchmark                   Run benchmark
       --benchmark-mode              Benchmark-mode, see references below

* Misc:

       --hex-salt                    Assume salt is given in hex
       --hex-charset                 Assume charset is given in hex
       --force                       Ignore warnings
       --status                      Enable automatic update of the status-screen
       --status-timer=NUM            Seconds between status-screen update

* Markov:

       --markov-hcstat               Specify hcstat file to use, default is hashcat.hcstat
       --markov-disable              Disables markov-chains, emulates classic brute-force
       --markov-classic              Enables classic markov-chains, no per-position enhancement
  -t,  --markov-threshold=NUM        Threshold when to stop accepting new markov-chains

* Session:

       --runtime=NUM                 Abort session after NUM seconds of runtime
       --session=STR                 Define specific session name
       --restore                     Restore session from --session
       --restore-timer=NUM           Save restore file each NUM seconds

* Files:

  -o,  --outfile=FILE                Define outfile for recovered hash
       --outfile-format=NUM          Define outfile-format for recovered hash
       --outfile-watch=NUM           Check outfile every NUM seconds for
                                     Cracked hash and abort if exists
  -p,  --seperator=CHAR              Define seperator char for hash and outfile

* Resources:

       --cpu-affinity=STR            Locks to CPU devices, seperate with comma
       --gpu-async                   Use non-blocking async calls (NV only)
  -d,  --gpu-devices=STR             Devices to use, separate with comma
  -n,  --gpu-accel=NUM               Workload tuning: 1, 8, 40, 80, 160
  -u,  --gpu-loops=NUM               Workload fine-tuning: 8 - 1024
       --gpu-temp-disable            Disable temperature and fanspeed readings and triggers
       --gpu-temp-abort=NUM          Abort session if GPU temperature reaches NUM degrees celsius
       --gpu-temp-retain=NUM         Try to retain GPU temperature at NUM degrees celsius (AMD only)

* Custom charsets:

  -1,  --custom-charset1=CS          User-defined charsets
  -2,  --custom-charset2=CS          Example:
  -3,  --custom-charset3=CS          --custom-charset1=?dabcdef
  -4,  --custom-charset4=CS          Sets charset ?1 to 0123456789abcdef

* Attack options:

       --pw-min=NUM                  Password-length minimum
       --pw-max=NUM                  Password-length maximum
  -s,  --pw-skip=NUM                 Start cracking at NUM
  -l,  --pw-limit=NUM                Abort cracking at NUM

==========
References
==========

* Benchmark Settings:

    0 = Default Tuning
    1 = Performance Tuning

* Outfile Formats:

    1 = hash[:salt]
    2 = plain
    3 = hash[:salt]:plain
    4 = hex_plain
    5 = hash[:salt]:hex_plain
    6 = plain:hex_plain
    7 = hash[:salt]:plain:hex_plain

* Built-in charsets:

   ?l = abcdefghijklmnopqrstuvwxyz
   ?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
   ?d = 0123456789
   ?s =  !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
   ?a = ?l?u?d?s
   ?h = 8 bit characters from 0xc0 - 0xff
   ?D = 8 bit characters from german alphabet
   ?F = 8 bit characters from french alphabet
   ?R = 8 bit characters from russian alphabet

* Hash types:

    0 = MD5
   10 = md5($pass.$salt)
   11 = Joomla
  100 = SHA1
  101 = nsldap, SHA-1(Base64), Netscape LDAP SHA
  110 = sha1($pass.$salt)
  111 = nsldaps, SSHA-1(Base64), Netscape LDAP SSHA
  112 = Oracle 11g, SHA-1(Oracle)
  131 = MSSQL(2000)
  132 = MSSQL(2005)
  300 = MySQL
  900 = MD4
  910 = md4($pass.$salt)
 1000 = NTLM
 1100 = Domain Cached Credentials, mscash
 1400 = SHA256
 1410 = sha256($pass.$salt)
 1500 = descrypt, DES(Unix), Traditional DES
 1700 = SHA512
 1710 = sha512($pass.$salt)
 2400 = Cisco-PIX MD5
 2600 = md5(md5($pass))
 2611 = vBulletin < v3.8.5
 2711 = vBulletin > v3.8.5
 2811 = IPB2+, MyBB1.2+
 3000 = LM
 3100 = Oracle 7-10g, DES(Oracle)
 5000 = SHA-3(Keccak)
 5100 = Half MD5
 5500 = NetNTLMv1-VANILLA / NetNTLMv1+ESS
 5600 = NetNTLMv2
 5700 = Cisco-IOS SHA256

• * Indicates that the value is depending on algorithm (see below)
• + Indicates that the value is depending on GPU platform vendor. NVidia = 8, AMD = 160.

NOTE: A value “0” or “NULL” can mean undefined, unlimited or all.

If you omit the optional mask at commandline, the following Mask is used:

• --custom-charset-1 = ?l?d?u
• --custom-charset-2 = ?l?d
• --custom-charset-3 = ?l?d*!$@_

?1?2?2?2?2?2?2?3?3?3?3?d?d?d?d

• + Indicates that the --hex-charset flag is automatically enabled.
• - Indicates that the --hex-salt flag is automatically enabled.
• * Indicates that the salt/username is part of the plaintext and thus its length have to be subtracted from the maximum length.

• Markov attack
• Brute-Force attack
• Mask attack

If you want to automatically check the status of the progress it is a good idea to parse the restore-file rather than to parse STDOUT.

There is just one entry in the restore-file of the following datatype:

typedef struct
{
  uint   version_bin;
  char   cwd[256];
  uint   argc;
  char   argv[30][256];
  uint   pw_min;
  uint64 pw_skip;
  pid_t  pid;
  char   unused[228];

} restore_data_t;

• “version_bin” is the version of oclHashcat-lite that was used to create the file.
• “cwd” is the current working directory. oclHashcat-lite will cd to that directory on startup if it is in --restore mode.
• “argc” and “argv” is the argument line itself, 1:1 copied.
• “pw_min” is the current password length that is checked.
• “pw_skip” is current position of the word-generator. It is updated blockwise after all GPUs are done with their specific keyspace.
• “pid” is the current pid oclHashcat-lite is running with. This is used for to avoid multiple instances of the same session name.
• “unused” is unused yet.

The frequency when the restore-file is updated has changed with v0.07. It is now written asychonously as soon as there is an update ready.

Before v0.07, the restore-file was updated only once per minute while you could use the --restore-timer parameter to increase this.

Please refer to the homepage to get latest benchmarks.

• Since we are using a mask attack it makes no sense to add “slow” algorithms like md5crypt, mscash2 or phpass. For those, use oclHashcat-plus.
• Due to its architecture, only XXX($pass.$salt) algorithms can be implemented. Algorithms using the opposite XXX($salt.$pass) can not be implemented.
• Increment mode is turned on and you can only turn it off by setting --pw-min and --pw-max to an equal value.

• None