2025-01-06 15:37:00
Just a gentle reminder that you really shouldn't try to use Hashcat (the password cracker) in a virtual machine. Not even in UTM on aarch64.
Instead, install it on your host OS so it can properly make use of the GPU in your computer for accelerated cracking. On MacOS it's as simple as "brew install hashcat".
It's not super-fast on my M2 Macbook Air, I'll give you that.
Running: hashcat --username -m 7300 ipmi.txt -a 3 "?1?1?1?1?1?1?1?1" -1 "?d?u"
Hash.Mode........: 7300 (IPMI2 RAKP HMAC-SHA1)
Hash.Target......: 0d7bd5208204000049bc6aa3b42dabc39b36794995510217ff9...c8bbc7
Guess.Mask.......: ?1?1?1?1?1?1?1?1 [8]
Guess.Charset....: -1 ?d?u, -2 Undefined, -3 Undefined, -4 Undefined
Speed.#1.........: 134.2 MH/s (10.98ms) @ Accel:192 Loops:16 Thr:64 Vec:1
Hardware.Mon.#1..: Util:100%
EDIT:
I've reconsidered. I uninstalled the Homebrew version of Hashcat and built it from source. Running it now, it doesn't use Metal but OpenCL. Performance is somewhat better on my M2.
Hash.Mode........: 7300 (IPMI2 RAKP HMAC-SHA1)
Hash.Target......: 0d7bd5208204000049bc6aa3b42dabc39b36794995510217ff9...c8bbc7
Guess.Mask.......: ?1?1?1?1?1?1?1?1 [8]
Guess.Charset....: -1 ?d?u, -2 Undefined, -3 Undefined, -4 Undefined
Speed.#2.........: 157.7 MH/s (10.20ms) @ Accel:256 Loops:512 Thr:64 Vec:1
Hardware.Mon.#2..: Util:100%
kilala.nl tags: work, studies,
View or add comments (curr. 4)
Posted by Tess
Well, this is depressing.
The ten year old GTX 960m, in the gaming laptop Dick once gifted me, gets 170MH/s. More than my M2. Either I've got very wrong settings, or I really need to setup a temporary GPU-outfitted VM on Azure.
All the more so, because my M2 seems to have crapped out around the 13% mark, crashing down to 75MH/s.
Posted by Tess
Yeah, using the rockyou.txt wordlist went a lot faster than all the permutations of 8-char passwords. This literally got it in a second, even with "just" 96MH/s.
$ ~/git/hashcat/hashcat --username -m 7300 -a0 ipmi.txt rockyou.txt --show
10.129.216.180 admin:0d7bd5208204000049bc6aa3b42dabc39b36794995510217ff9dac58a8e99a10ea2bef4db221a85ba123456789abcdefa123456789abcdef140561646d696e:4dd1d0f32eceefe784736a70a32a19330bc8bbc7:trinity
Posted by Tess
I've been looking around a little bit, comparing Hashcat benchmarks for mode 1400 (SHA2):
I wasn't expecting stellar figures, but I was definitely expecting to out-score a GPU from eight years ago.
EDIT:
Apparently an M2 Max gets around 2500 MH/s... that's more like it, though still not awesome.
All content, with exception of "borrowed" blogpost images, or unless otherwise indicated, is copyright of Tess Sluijter. The character Kilala the cat-demon is copyright of Rumiko Takahashi and used here without permission.
2025-01-06 16:19:00
Posted by Tess
For reference, here's what I'm cracking:
10.129.216.180 admin:0d7bd5208204000049bc6aa3b42dabc39b36794995510217ff9dac58a8e99a10ea2bef4db221a85ba123456789abcdefa123456789abcdef140561646d696e:4dd1d0f32eceefe784736a70a32a19330bc8bbc7