Didier Stevens

generate-hashcat-toggle-rules.py is a Python program to generate hashcat toggle rules. Toggle rules toggle the case of letters in words present in a dictionary.

Hashcat comes with toggle rule files for candidate passwords up to 15 characters long. There’s a rules file that will toggle exactly one letter (toggles1.rule), another rule file for up to two letters (toggles2.rule), three, four, and finally a rule file for up to five letters (toggles5.rule). Hashcat does not provide rules with more than five toggles, as empirical data shows that passwords chosen by users only contain a couple of uppercase letters.

These toggle rule files can also be generated with generate-hashcat-toggle-rules.py.

This command generates rules identical to toggles5.rule:

generate-hashcat-toggle-rules.py 5

But I want to crack NTLM hashes for randomly generated passwords, and for which I already cracked the LM hash. So I must toggle up to 14 letters. I can use the following command to generate this toggle rule file:

generate-hashcat-toggle-rules.py -n -p 14 14 > toggles-lm-ntlm.rule

-n will include rule :. This rule makes no changes (nothing) to the candidate password. This way I can run hashcat only once with the rule file. I don’t need to run hashcat with and without rule file.

-p 14 generates toggles up to position 14 (the default is up to position 15, but since LM hash passwords are maximum 14 characters long, it’s useless to generate toggles for position 15).

Here is part of this generated file toggles-lm-ntlm.rule:

:
T0
T1
T2
T3
T4
T5
T6
T7
T8
T9
TA
TB
TC
TD
T0T1
T0T2
T0T3
T0T4
T0T5
...
T1T3T4T5T6T7T8T9TATBTCTD
T2T3T4T5T6T7T8T9TATBTCTD
T0T1T2T3T4T5T6T7T8T9TATBTC
T0T1T2T3T4T5T6T7T8T9TATBTD
T0T1T2T3T4T5T6T7T8T9TATCTD
T0T1T2T3T4T5T6T7T8T9TBTCTD
T0T1T2T3T4T5T6T7T8TATBTCTD
T0T1T2T3T4T5T6T7T9TATBTCTD
T0T1T2T3T4T5T6T8T9TATBTCTD
T0T1T2T3T4T5T7T8T9TATBTCTD
T0T1T2T3T4T6T7T8T9TATBTCTD
T0T1T2T3T5T6T7T8T9TATBTCTD
T0T1T2T4T5T6T7T8T9TATBTCTD
T0T1T3T4T5T6T7T8T9TATBTCTD
T0T2T3T4T5T6T7T8T9TATBTCTD
T1T2T3T4T5T6T7T8T9TATBTCTD
T0T1T2T3T4T5T6T7T8T9TATBTCTD

The generated toggle rule file toggles-lm-ntlm.rule is included in the ZIP file:

generate-hashcat-toggle-rules_v0_0_1.zip (https)
MD5: 170F54D69C8581B9379E11E14F31C39E
SHA256: 93AE3CC8123425CEBC85D6CA4DE1ED1DD14F492AB744368729FB38D24436B5D9