Thireus' Bl0g

Tag: CPU

Look Back on 2012’s Famous Password Hash Leaks – Wordlist, Analysis and New Cracking Techniques

by Collaborative_Work on Jan.01, 2013, under Crack1ng, Hack1ng. 0 views

Look Back on 2012 Famous Password Hash Leaks - Wordlist, Analysis and New Cracking Techniques

This article is a collaborative work between 3 authors. This is our look back on 2012’s most famous public password leaks.

Authors: m3g9tr0n, Thireus, CrackTheHash | Copy Editor: Thireus.

Nowadays, different hacking communities around the World publish their leaks on various online paste Web Services like Pastebin,, and others. The most usual target’s vulnerability is SQL Injection. These leaks contain elements like usernames, passwords, addresses, zip codes, telephone numbers and even paypal accounts or credit card nubers. In a small amount of them, passwords are in plain text which makes hackers’ job very easy.

In this article, we gathered a big amount of public published leaks with main purpose to check the strength of users’ passwords and password policy which is applied for each service. Some well known leaks, included in our article, are LinkedIN, Stratfor, Gamigo, NVidia, Adobe and eHarmony. We are going to present our cracking techniques and tools which we used to crack passwords from these leaks. And as a gift gave to our readers, you will find attached to the end of this article a wordlist containing all cracked passwords from these leaks. :-D


The tools we used to accomplish our cracking process are John the Ripper and Hashcat-suite. In other words, we took advantage of both CPU and GPU.

When dealing with password cracking the most important thing is to know as many elements as possible about your target. For the case of Stratfor we had all the appropriate elements needed for effective password cracking. These are usernames, first name, last name and e-mails. Many users use their e-mail or username (or part of) as password or keyword. Knowing these information really speeds the cracking process as it is more effective to create a wordlist based on these information for our first cracking step. On the other side,  LinkedIN and other well known leaks contained only hashes… that makes the cracking process more difficult and time consuming. But, with good rules and techniques some interesting results can be achieved. For better documentation, we are going to analyze each case separately by showing the techniques and custom rules.

Stratfor Case

Regarding Stratfor, we had all the appropriate elements needed for effective password cracking. The first action was to separate names, usernames, e-mails and encrypted passwords to different files. In a first attempt we used John the Ripper’s –single attack which is a cracking attack purely based on usernames associated to hashes (Hashcat-suite does not provide such an attack). The hashfile must have this kind of format for the attack to be effective:
  • John the Ripper command for –single attack against MD5:
m3g9tr0n@linux:~/JohnTheRipper-OMP/run/$ ./john --format=raw-md5 --single --pot=stratfor.pot Stratfor-hashes.txt

This kind of attack was able to crack many passwords. When I (m3g9tr0n) am trying to crack passwords, my first reaction is to apply effective rules against effective wordlists. As far as John the Ripper is concerned, I always try Single, Extra, Jumbo and rules presented in my first article plus some rules generated by Bartavelle. Regarding Hashcat-suite our favourite rules are best64.rule, best80.rule, passwordpro.rule, T0XlC.rule and d3ad0ne.rule.

  • A typical example of a wordlist attack with John the Ripper is:
m3g9tr0n@linux:~/JohnTheRipper-OMP/run/$ ./john --format=raw-md5 --wordlist=list.txt --pot=stratfor.pot --rules:Single Stratfor-hashes.txt
  • A typical example of a wordlist attack with oclHashcat-plus (GPU based) is:
m3g9tr0n@linux:~/oclHashcat-plus0.09/$ ./oclHashcat-plus64.bin -m 0 hashfile.txt list.txt -r rules/best80.rule -o hashfile-crack.txt --remove

During our cracking processes against Stratfor, we observed that many passwords contained the word “stratfor”. Based on this observation, we considered to generate our own rule that appends or prepends this keyword at the begining and at the end of each word of a given wordlist. The following code is an example of rule created for John the Ripper in the john.conf file.


After cracking a big amount of passwords, we generated a custom charset with John the Ripper.

  • A typical example to generate your own charset file with John the Ripper:
m3g9tr0n@linux:~/JohnTheRipper-OMP/run/$ ./john --make-charset=stratfor.chr --pot=stratfor.pot
  • And the associated incremental rule in john.conf file:
File = $JOHN/stratfor.chr
MinLen = 10
MaxLen = 31
CharCount = 95

The charset file can be used to conduct Brute Force attack with John the Ripper based on Markov model.

  • A typical example of Brute Force attack with Markov model in John the Ripper is:
m3g9tr0n@linux:~/JohnTheRipper-OMP/run/$ ./john --format=raw-md5 --incremental=stratfor --pot=stratfor.pot hashfile.txt

We left John the Ripper to run for a large amount of time. Many passwords were cracked, but the most important was that a large amount of these recovered passwords using this method were 8 characters mixed upper, lower and numbers. Thus, we understood that Stratfor had a policy of generating either default or recovered passwords with this policy for their users. Our first thought was to use pwgen utility in order to produce random passwords based on this policy.

  • A typical example of pwgen to generate 8 characters mixed upper, lower and numbers:
m3g9tr0n@linux:~/JohnTheRipper-OMP/run/$ pwgen -c -n -s -1 8 5

Of course in our case we should generate more passwords and pipe pwgen’s output to John the Ripper or Hashcat-Suite. But this kind of attack is too slow. For that reason we should take advantage of GPU. We applied Brute Force attack via oclHashcat-plus.

  • A typical example of Brute Force attack with oclHashcat-plus:
m3g9tr0n@linux:~/oclHashcat-plus0.09/$ ./oclHashcat-plus64.bin -a 3 -1 ?l?d?u hashfile.txt ?1?1?1?1?1?1?1?1 -o hashfile-crack.txt --remove

This kind of attack took 2 days and 17 hours to complete with an ATI 5770 but it was only able to crack 48% of passwords.

  • Some examples of cracked passwords generated from Stratfor’s policy are:

eHarmony Case

Regarding eHarmony it seems that the website had a policy to covert all users’ passwords to UpperCase. For example, if you had inserted, as a registered user, the password “p@$$w0rd”, eHarmony’s system would have converted it to “P@$$W0RD”.

The first thought that came up to my mind was to write a simple rule for John the Ripper to convert all my wordlists to uppercase characters:


Then, I applied this Rule to John the Ripper and a large amount of passwords were cracked very fast:

m3g9tr0n@linux:~/JohnTheRipper-OMP/run/$ cat ../Wordlists/* | ./john --format=raw-md5 --pipe --pot=eharmony.pot --rules:eharmony hashfile.txt

Due to the fact that my wordlists do not contain only uppercase letters, numbers and symbols it was a waste of time to apply other rules against eHarmony hashes. So I decided to convert the most effective wordlists to uppercase characters, using the above mentioned rule, and apply some specific rules:

  • Convert a wordlist to uppercase with John the Ripper:
m3g9tr0n@linux:~/JohnTheRipper-OMP/run/$ cat ../Wordlists/* | ./john --pipe --rules:eharmony --stdout > ../Wordlists/UpperList.txt

Then, I used the –wordlist attack with John the Ripper using the following rules (it is a sample you can add more):


Of course, you can always generate your own rules or modify existing custom rules contained in the john.conf file. In addition to this, Hashcat’s Suite rules can be used. One simple rule is to use the keyword “EHARMONY” at the beggining or at the end of each word:


For people who do not own strong hardware and adequate disk space, Hashcat-suite contains a powerfull parameter which has to do with combination. In other words, you can combine each word of your first wordlist with the other.

  • Thus, I generated some wordlists via crunch, such as the following one of 4 ualpha-numeric characters:
m3g9tr0n@linux:~/crunch3.1/$ ./crunch 4 4 -f charset.lst ualpha-numeric -o 4-list.txt
  • And used combination attacks with oclHashcat-plus:
m3g9tr0n@linux:~/oclHashcat-plus0.09/$ ./oclHashcat-plus64.bin -a 1 hashlist.txt ../crunch3.1/4-list.txt ../crunch3.1/4-list.txt -o hashfile-crack.txt --remove

Methodology for Other Leaks

Regarding other leaks such as Nvidia, Gamigo, Adobe, Project Whitefox, LinkedIN and various unknown leaks collected from Pastebin, the tools and methodoly are the same. The only difference is that in each situation we have to create custom rules that refer to the name of the platform/website or by guessing some keywords.

  •  John the Ripper Rules for Nvidia:
  • John the Ripper Rules for Adobe:

You can also create similar rules for Hashact-Suite.

Another effective technique is fingerprint attack. This is attack is focused on using cracked passwords against remaining hashes.

  • To isolate cracked passwords from .pot files (John the Ripper or Hashcat-suite) use:
cut -d: -f2- john.pot | sort | uniq > list.txt
  • In Hashcat-suite to isolate MD5 cracked passwords (from output with the -o option), use:
cut -b34- crack-file.txt | sort | uniq > list.txt

Then you can try all the rules mentioned above. From my own experience this technique has always great results.


During your cracking sessions you may certainly have noticed that most of the passwords used by users are always made of “keywords”. This can easily be noticed when dealing with big leaks such as LinkedIn, Gamigo or Stratfor. These keywords are interesting for us, as they are used by users consciously or unconsciously in their passwords. Fortunately for us, lot of users use the same keywords and if you want to go further in your cracking process the main idea will be to use these keywords as roots for generating new passwords. In this article section I (Thireus) will introduce you a new cracking technique based on this idea. But first of all let me explain what those keywords are exactly and why they can be so useful…

About “Keywords”…

Basically keywords can be described as passwords or part of passwords that appear as intelligible or used by multiple users. Let’s focus on the following example:


These passwords have the keyword “l0v3s” in common, which can be found at the begining, at the end or in the middle of the password. A common mistake would be to think that re-using these passwords with various rules will make more “l0v3s” based passwords appear, which is false because most of the rules you use will never extract the “l0v3s” pattern only, but combine or tranform each of these passwords… And yet, you keep thinking that there should be more words containing this keyword… and you are right! :-)

As explained in this section’s introduction, keywords are not just words, they are part of passwords that are intelligible or repeated among multiple users’ passwords. Here are some example of keywords:


Keywords can be anything intelligible or not. The most important think about keywords is that they are not random, ideally generated by humans AND have a high probability to appear in other passwords. And of course keywords can be part of other keywords, for example:

inked –> Linked, linked, winked, inkedIN, etc.

Another nice property of keywords is that they are independant of the password size. And a weak password (understand easily crackable with BruteForce/Rules/Wordlists) can contain a specific keyword, that you can use to crack other strong passwords. Let’s see for example how the following passwords have been cracked:


M00linkedin13 –> Was cracked because it contains the keyword “linkedin13” which is part of more than 40 other linkedin passwords and is also a weak linkedin password. M00linkedin13 = 3chars + keyword
0linkedin1-us2 –> Was cracked because it contains the keyword “0linkedin1” which is part of “M00linkedin13” and 1 other linkedin password. 0linkedin1-us2 = keyword + 4chars

The padding technique – CTH_WordExtractor

So the main idea that can cross your mind would be to manually analyse your cracked passwords and look for good keywords, to finally write rules based on those few keywords… But what if there are so many keywords that you can’t even complete all this work manually? The answer is to have a keyword extractor based on your results, and (from my “Crack That Hash” project) is the script I have created for this purpose! ;-)

You can get the script here:

This script helps you to extract all potential keywords directly from your current pot file. Basically what this script does is:

  1. Read all passwords and use a padded window which padding and size vary from X to Y as defined by the user.
  2. Sort extracted words by size and for each word count its redundancy in all passwords.
  3. Ask the user to select a range of redundancy to select only good words. In other words to select real “keywords”.
  4. Generate keyword wordlists from X chars to Y chars to be used by the user.

In the case of LinkedIN passwords, a 4-6chars keyword wordlist would contain the following keywords (this is just a little sample):


This wordlist will be used to append and prepend characters using BruteForce and Mask attack (which is the most effective). As you can see, most of these keywords are part of other keywords… and you can think this is actually very bad in term of performances… but it is not :-) … let’s see why.

Let’s take the example of the “inke” keyword…

BruteForce + Mask attack with ?l will generate 26 possibilities per keyword:

inke –> ?l + inke = 26 possibilities

But ONLY 1 will cause a repeated password which is “linke“.

The next step of the process will be to use BruteForce + Mask attack with ?l?l which will generate 26^2=676 possibilities per keyword:

inke –> ?l?l + inke = 676 possibilities

But ONLY 26 will cause repeated passwords which are those that have been generated by ?l + “linke“.


And for sure, we have been able to recover all passwords containing the keyword inke, including unexpected passwords such as:


The Proper Way to Use Generated Keyword Wordlists

First of all, this technique becomes more effective and useful when you reach your limits with other classic cracking techniques. Meaning that if you want to have a very good keyword wordlist you need a very big pot file.

Then, this technique must be used with GPU BruteForcing + Mask attack or using combination attacks. Applying classic John the Ripper or Hashcat rules on the keyword wordlist will not be effective at all and will be very slow. In this article I will only take as example the GPU BruteForcing + Mask attack.

  • First of all, we need to generate our keyword wordlists from 4 to 14 chars. Let’s do this for the john.pot of our LinkedIN cracked passords:
$ ./ 4 14

Other settings can be found in the script such as padding limits.

  • This is the list of wordlists generated:
$ ls CTH/

CTH_WORDLIST_FINAL_4-14.dic for example means WORDLIST from 4 to 14 chars.

  • Then we can select a specific wordlist to be used by cudaHashcat-plus or oclHashcat-plus:
$ ./cudaHashcat-plus64.bin -m 100 -a 6 -1 ?a ../LEFT_LINKEDIN_CLEANED.txt ../CTH/CTH_WORDLIST_FINAL_4-11.dic ?1?1?1?1 --remove --gpu-temp-abort=110

In this example, CTH_WORDLIST_FINAL_4-11.dic has been choosen because oclHashcat-plus/cudaHashcat-plus has a limit of 15 chars for hash computation. Which means you will never be able to crack passwords that are more than 15 chars long… And that’s why if you use a mask attack of 4 chars to be bruteforced you must use a wordlist containing words limited to a size of 11 chars.

  • This is an output sample:
[s]tatus [p]ause [r]esume [b]ypass [q]uit => s
Status.......: Running
Input.Base...: File (../CTH/CTH_WORDLIST_FINAL_4-11.dic)
Input.Mod....: Mask (?1?1?1?1)
Hash.Target..: File (../LEFT_LINKEDIN_CLEANED.txt)
Hash.Type....: SHA1
Time.Running.: 1 day, 7 hours
Time.Left....: 3 hours, 59 mins
Time.Util....: 112529717.4ms/0.0ms Real/CPU, 0.0% idle
Speed........: 35724.6k c/s Real, 36175.5k c/s GPU
Recovered....: 292/1086109 Digests, 0/1 Salts
Progress.....: 4020080601574/4533053083750 (88.68%)
Rejected.....: 0/4020080601574 (0.00%)
HWMon.GPU.#1.: -1% Util, 82c Temp, -1% Fan

And as we can see some interesting keywords have been selected, such as “rottweiler“, “Networking“, “Interactive“, “artdirector“, “Inspiration“, and of course keywords containing the word “linkedin“.
You can also notice that I’m not using a very powerful GPU :-) , but a laptop with a “NVIDIA NVS 3100m” chip. So you can imagine how powerful this method can be with a better GPU! ;-)

To conclude on my new technique, I would say that it was very successful. :-) I’ve been able to recover more than 1 million passwords after having exhausted all the classic techniques I usually use, and that in just 13 days with a NVidia GTX 480 and an AMD HD6870. This 1 million result was mainly against Gamigo, eHarmony and Stratfor and after an initial achievment of about 80% recovered passwords. And one thing to consider is that to go further in the cracking process and have an optimized cracking methodology, I prefered merging multiple MD5 leaks into one big MD5 leak and use this technique against the merged pot file to generate my keywords. As explained before, you will find this technique more useful in the case of very big leaks and very big pot files.

Please consider my script as a Xmas gift. I would love to receive feedbacks about your results with it. Of course, if you have ideas to ameliorate this script or this technique do not hesitate to contact me. :-)


The main purpose of most of the classic cracking techniques are to guess the most common patterns in users’ passwords. Those techniques are either dealing with rules or wordlists, but in any case for them to be the most effective possible they need good candidate passwords as root of the technique process. But how can you find those good candidate passwords? The purpose of this part will be to explain a technique to find fresh new candidates from various sources such as Pastebin or Twitter.

First of all, to understand what brought me (CrackTheHash) on this methodology field, you need to know something about my hardware resources. They are very limited! I just own a dual-opteron with 2GB RAM. And for this reason, I do not want to exhaust my CPU for cracking hashes that everyone can easily recover. So I decided to focus my research on finding sources of good candicate passwords to be used for cracking techniques.

In order to know what we are looking for, let’s write some principles that will rule our research. Those principles are based on the password characteristics for them to match at best the requirements of good candidates. And they are the following:

  1. Password candidates must be up to date.
  2. Password candidates must be representative of what people may use.
  3. Password candidates must be multilingual (passwords in Russian, Chinese, Greek, Farsi, etc.).
  4. Password candidates must be available in large quantity.

There are multiple sources on the Internet where you can find a large amount of data containing password candidates, but only a few will fill those requirements. For the needs of this article we will focus only on two platforms and sources of good password candidates, Pastebin and Twitter.


Pastebin is probably the first Web location where you can find lot of fresh leaks and various user data. What is very interesting in most of the leaks we can find on Pastebin is that they often include real passwords in plaintext. So, monitoring Pastebin is quite interesting and useful to get fresh new candidate passwords. On top of that, there are several resources on the Internet, that will help you to monitor and download the latest Pastebin leaks. Portals like Leakedin, @Pastebindorks or @PastebinLeaks or projects like pastemon and pasteminer are good examples of sources and tools you can use.

Unfortunately, in order to generate effective wordlists you have to create some further scripting because the data does not come very well parsed. The first step and ordinary solution to parse the Pastebin data is to generate a wordlist using the space or tab character as separator and replace it with a line break. This way may lead to miss some interesting cadidates as in some leaks or cracking results. Most of the time you will find lines containing “username :-p assword”, “username | password” or even worse, direct sqlmap output, etc. So you have to be clever and find the best way to parse those leaks to create useul wordlists.

In any case, Pastebin can help us to build useful wordlists, because everyday new leaks are uploaded. The produced wordlists are not that amazing in term of quantity, but usually their content is valuable.


Nowadays people tend to use sentences or combination of words for their passwords. They have been advised to do this as it is considered to be a strong and easy to remember way to create passwords. So I decided to use one of the the best sentence generator ever… Twitter! :-D Indeed, everyday people generate tweets with fresh content and in this case our password candidates are just what people are saying. :-)

The most important things about Twitter are that this social platform generates a lot of public and fresh data, is international and tweets are short enough to be parsed individually! On top of that, wordlists generated via Twitter can continuously feed John the Ripper.

So the first step is to grab live Twitter’ content. In order to achieve this, Twitter provides a live-feed query that gives you a full json of tweets with all the data you need. The only elements that are required to perform this query are a valid Twitter username and password:

curl --user <username>:<password>

To get only the tweet content you have to parse it a bit. First we may need the ‘-m’ argument of curl to timeout just in case of network trouble and then grep the data received with the keyword \”text\”.

curl -m 10 --user <username>:<password> | grep \"text\"

Once received, the result must be parsed because it comes with Unicode escaped characters. Something like the following script will do the trick:

import json, sys
for data in sys.stdin:
   print twit.encode('utf-8')
print "done"

The above few lines of Python code can be directly used to generate candidate passwords, which means keeping the whole sentence of the tweet. Another approach is to use each word of the tweet as a candidate password. Furthermore, an interesting idea is to combine tweet words with others.

What we can do is generate combinations of 4 words. Best results are by combining with or without space separators.

Here is a small Python script I wrote to performe this task, the input file is “tweets.txt”:

import sys
def combinations(words, length):
    if length == 0:
        return []
    result = [[word] for word in words]
    while length > 1:
        new_result = []
        for combo in result:
            new_result.extend(combo + [word] for word in words)
        result = new_result[:]
        length -= 1
    return result
for i in linesin:
  thisline=i.rstrip("\n").split(" ")
  for j in combinations(thisline,4):
    print '%s' % ''.join(map(str,j))
    print '%s' % ' '.join(map(str,j))
  for j in combinations(thisline,3):
    print '%s' % ''.join(map(str,j))
    print '%s' % ' '.join(map(str,j))
  for j in combinations(thisline,2):
    print '%s' % ''.join(map(str,j))
    print '%s' % ' '.join(map(str,j))
  for j in thisline[:]:
    print j

As far as size is concerned, 10 seconds of live Twitter feed will give you about 1.5 MB and about 600 tweets. This size can be reduced down to 50 KB when keeping only the parsed tweet contents. This combination script will give you around 50 Million candidate passwords to test.

Those two approaches, are not the most effective for cracking million passwords. But for sure, they will give you interesting results such as passwords considered as very strong that have even resisted to lots of GPUs’ on fire. :-D


As you might expect, we are not professional password crackers. Password cracking is a hobby for us. Actually, our hardware resources are limited. And bruteforcing passwords is not the most time friendly way, unless you own many GPUs and strong hardware. For this reason, we are tryining to discover new and effective techniques to crack complex passwords.

But always keep in mind that any platforms, websites and online services are never entirely protected against hacking and data leaks. So we would like to give some advices in order to protect your passwords in case critical senarios such as LinkedIN leak happen:

  • Never share passwords
  • Never use the same password
  • Always use strong passwords
  • Do not use common words
  • Change your passwords in a regular basis

We hope you enjoyed reading this article. Find attached at the end of this article our new wordlist as a late Xmas gift. And of course…

HAPPY NEW YEAR 2013!!! :-D

Version: 1.0
75.8 MB


Project Whitefox
Various leaks collected from Pastebin

Some Results

        Loaded 6458020 password hashes SHA-1 LinkedIn
        Remaining 1078419 password hashes
        Loaded 5787239 password hashes SHA-1 LinkedIn
        Remaining 880786 password hashes
        Loaded 7004341 password hashes MD5
        Remaining 1019934 password hashes
        Loaded 630 password hashes MD5
        Remaining 95 password hashes
        Loaded 15932 password hashes MD5
        Remaining 4967 password hashes
        Loaded 1513805 password hashes MD5
        Remaining 134345 password hashes
        Loaded 32502 password hashes MD5
        Remaining 4180 password hashes
        Loaded 791 password hashes MD5
        Remaining 354 password hashes
        Loaded 822666 password hashes MD5
        Remaining 58694 password hashes

*, ** The initial LinkedIN hashlist contains 00000ed and non-00000ed SHA1 hashes. A lot of 00000ed hashes still have their duplicate non-00000ed hash in the list. For instance, if you crack the initial LinkedIN hashes with our wordlist you will find 473148 duplicates between 00000ed and non-00000ed, and if you are using John the Ripper with –format:raw-sha1-linkedin you will need to run the process twice to write duplicates (either the 00000ed or non-00000ed version) in your POT file. If you have already considered duplicates as non-useful, then the right results to consider are the ones from the CLEANED version.

Some Pipal Analysis


The wordlist provided in this article has been created using all the presented cracking techniques against public leaks only. Do not expect to find new passwords using the same leaks and techniques presented here.

As always it is up to the reader to use this wordlist to do password recovery. We do not take any responsibility if some of your passwords can be found in this wordlist or be recovered using our techniques. Be aware that the best way to protect you is always to change your passwords as often as possible.

Incoming search terms:

6 Comments :, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , more...

Cracking Story – How I Cracked Over 122 Million SHA1 and MD5 Hashed Passwords

by m3g9tr0n on Aug.28, 2012, under Crack1ng, Hack1ng. 0 views

This is the story about how I cracked 122 million* password hashes with John the Ripper and oclHashcat-plus.

Author: m3g9tr0n, Copy Editor: Thireus.

It was several months ago, when I (m3g9tr0n) saw a tweet from KoreLogic about a torrent file containing various password hash lists for a total of 146 million passwords. This very big amount of password hashes at first discouraged me, as I only own a classic computer configuration with an AMD Phenom II 4 cores at 3,2 Mhz in addition to an ATI/AMD 5770 graphics card. But at least, I really wanted to give them a try because the field of password cracking fascinates me.

The password cracking tools I used during this long trip were John the Ripper and oclHashcat-plus. This article is about cracking the provided MD5 hashes of KoreLogic only, but the same strategy was also applied to SHA1 hashes.


  • 08/29/2012 – New example in John the Ripper section: “Crack double MD5 hashes with the help of script”
  • 08/29/2012 – New download! All in one sorted and cleaned version.

Dealing with hashes…

First of all the KoreLogic torrent file file must be decompressed, it contains a folder named “hashes”. Let’s see the content of this folder…

root@m3g9tr0n:~/hashes$ ls
longer_salts  raw-md5.hashes.txt  salted_with_md5  SHA1  vBulletin-v3.8.4

We will concentrate here on the raw-md5.hashes.txt list. This file is 4.3 GB and includes 139444502 lines according to wc utility.

root@m3g9tr0n:~/hashes$ wc -l raw-md5.hashes.txt 
139444502 raw-md5.hashes.txt

As you consider, both John the Ripper and oclHashcat-plus are not able to load this file because it is too big. For that reason, we need to split this file. Under Linux we have a nice utility called split that does this job very well.

root@m3g9tr0n:~$ split --help
Usage: split [OPTION]... [INPUT [PREFIX]]
Output fixed-size pieces of INPUT to PREFIXaa, PREFIXab, ...; default
size is 1000 lines, and default PREFIX is `x'.  With no INPUT, or when INPUT
is -, read standard input.

Mandatory arguments to long options are mandatory for short options too.
  -a, --suffix-length=N   use suffixes of length N (default 2)
  -b, --bytes=SIZE        put SIZE bytes per output file
  -C, --line-bytes=SIZE   put at most SIZE bytes of lines per output file
  -d, --numeric-suffixes  use numeric suffixes instead of alphabetic
  -l, --lines=NUMBER      put NUMBER lines per output file
      --verbose           print a diagnostic just before each
                            output file is opened
      --help     display this help and exit
      --version  output version information and exit

SIZE may be (or may be an integer optionally followed by) one of following:
KB 1000, K 1024, MB 1000*1000, M 1024*1024, and so on for G, T, P, E, Z, Y.

We can use the –lines=NUMBER parameter to split our raw-md5.hashes.txt file.

root@m3g9tr0n:~/hashes$ split -l 3000000 raw-md5.hashes.txt part

Note that we can also split the file based on the amount of MBs by taking into consideration that each MD5 hash is 32 bytes long.

Cracking Passwords with oclHashcat-plus

I started with oclHashcat-plus because it contains the –remove option, which enable remove of hash from hashfile once it is cracked and is really convenient. The only limitation oclHashcat-plus has, is the constraint on password length. In other words, it is only able to crack passwords up to 15 characters. The rules that I used for oclHashcat-plus are base64.rule, passwordspro.rule, T0XlC.rule and in some cases d3ad0ne.rule. There rules can be found directly from the oclHashcat-plus suite.

Bruteforce techniques were not my first choice. I used wordlists which I download from g0tm1lk’s blogspot. You will find on g0tmi1k’s article other external links for more wordlists. The biggest part of cracking process was done by using these wordlists with the rules mentioned above. Let’s see some examples…

Using a single rule:

./oclHashcat-plus64.bin -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic -r rules/best64.rule -o Ultimate_Crack/eNtr0pY_1 --remove

Using Rules’ combination:

./oclHashcat-plus64.bin -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic -r rules/best64.rule r rules/passwordspro.rule -o Ultimate_Crack/eNtr0pY_1 --remove

Bruteforce attack with mask (you can specify whatever charset you want):

./oclHashcat-plus64.bin -a 3 -1 ?l?d?u?s -m 0 ~/hashes/md5_1 ?1?1?1?1?1?1?1?1 -o Ultimate_Crack/eNtr0pY_1 --remove

Combination attack:

./oclHashcat-plus64.bin -a 1 -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic ~/Wordlists/list -o Ultimate_Crack/eNtr0pY_1 --remove

Combination attack with rules:

./oclHashcat-plus64.bin -a 1 -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic ~/Wordlists/list -r rules/passwordspro.rule -o Ultimate_Crack/eNtr0pY_1 --remove

Permutation attack:

./oclHashcat-plus64.bin -a 4 -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic -o Ultimate_Crack/eNtr0pY_1 --remove

Permutation attack with rules:

./oclHashcat-plus64.bin -a 4 -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic -r rules/best64.rule -o Ultimate_Crack/eNtr0pY_1 --remove

In some cases, I used the hybrid + mask attack technique:

./oclHashcat-plus64.bin -a 6 -1 ?l?d -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic ?1?1 -o Ultimate_Crack/eNtr0pY_1 --remove

Hybrid + mask attack with rules:

./oclHashcat-plus64.bin -a 6 -1 ?l?d -m 0 ~/hashes/md5_1 ~/Wordlists/d3ad0ne.dic ?1?1 -r rules/best64.rule -o Ultimate_Crack/eNtr0pY_1 --remove

At this point, I did not use these last two methods as they are very time consuming. I rather found a better one using KoreLogic’s Rules for John the Ripper by piping the output of John the Ripper to oclHashcat-plus. As I mentioned, oclHashcat-plus is able to crack passwords up to 15 characters. For that reason, I had to define everytime, via the –stdout option, the length of the produced word. If you own a very fast GPU you do not have to use the following example.

./john --wordlist=~/Wordlists/all.lst -rules:KoreLogicRulesPrependYears --stdout=10 | ./oclHashcat-plus64.bin -m 0 ~/hashes/md5_1 -o Ultimate_Crack/eNtr0pY_1 --remove

Of course you can use other prepend rules created from Korelogic, like KoreLogicRulesPrependNumNum, or even better create your own rules! :-D

It was time to produce a wordlist from the cracked passwords and use it to crack the remaining hashes. From eNtr0pY_1, I removed the MD5 hashes with the following command.

cut -b34- eNtr0pY_1 > eNtr0pY_1.dic

By using the above produced wordlist, a big amount of MD5 hashes were cracked with the fingerprint attack. You can read more about this attack from Martin Bos @purehate and I guarantee that this technique is very successful!

Of course you can also use the binaries included into hashcat-utils and pipe the output of each util to oclHashcat-plus.

root@m3g9tr0n:~/oclHashcat-plus-0.08/hashcat-utils$ ls
combinator.bin  expander.bin  gate.bin  len.bin  mp32.bin  permute.bin  prepare.bin  req.bin  splitlen.bin

Cracking Passwords with John the Ripper

After testing all my wordlist collection and after several days, it was time to move to John the Ripper for cracking the rest of password hashes…

I used magnum-ripper compiled with OpenCL for ATI/AMD graphics card because I wanted to use the –format=raw-md5-opencl parameter. Compared to –format=raw-md5, it is way faster as it uses your CPU and GPU!

The Rules that were used with John the Ripper are wordlist, Single, NT, Extra, KoreLogicRulesAppendNumbers_and_Specials_Simple, KoreLogicRulesAppend6Num, KoreLogicRulesPrependAndAppendSpecial, KoreLogicRulesAppendNumNum_AddSpecialEverywhere, KoreLogicRulesAppendNumNumNum_AddSpecialEverywhere and KoreLogicRulesL33t.

Furthermore you can download these rules and add them to your john.conf file.

Let’s see now some examples with John the Ripper…

Using –rules=Single

./john --format=raw-md5-opencl --wordlist=../../Wordlists/all.lst --rules:Single ~/hashes/md5_1

The results of cracked hashes are stored in the john.pot file by default. You can examine its contents with cat, more, head and tail.

root@m3g9tr0n:~/Tools/Password_Cracking/magnum-jumbo-OpenCL/run$ tail -n 9 john.pot 

To produce a wordlist from the john.pot file, you can use the following command.

cut -d: -f 2- john.pot | sort -u > cracked.dic

The created wordlist can be used to crack more hashes when combined with the abovementioned rules.

When I was cracking MD5 hashes with oclHashcat-plus, I observed that some produced passwords were rejected. This is because oclHashcat-plus has a limitation about characters’ length. For that reason, I piped hashcat’s output to John the Ripper with the additional advantage of using hashcat rules with John the Ripper.

./hashcat-cli64.bin --stdout ~/Wordlists/d3ad0ne.dic -r rules/best64.rule | ./john --format=raw-md5-opencl --stdin ~/hashes/md5_1

After trying all the wordlists combined with the rules mentioned above, it was time to move to bruteforce attacks with John the Ripper. Unfortunately, John the Ripper does not use the mask attacks to produce passwords when implementing bruteforce attacks. We have to create our own charset based on cracked passwords contained in john.pot.

./john --make-charset=eNtr0pY.chr
Loaded 7948325 plaintexts
Generating charsets... 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 DONE
Generating cracking order... DONE
Successfully written charset file: eNtr0pY.chr (95 characters)

Many of you will wonder about “31 DONE”… ^^ This is just because I compiled John the Ripper with 31 characters’ length. By default, John the Ripper is compliled with 8 characters’ length, so it is best to change it by modifying the following lines of the header file params.h located in the scr folder of John the Ripper.

#define CHARSET_MIN                     ' '
#define CHARSET_MAX                     0x7E
#define CHARSET_SIZE                    (CHARSET_MAX - CHARSET_MIN + 1)
#define CHARSET_LENGTH                  8 //Change that to 31 or whatever you wish

At last you have to include your created charset to john.conf as given in this example:

# Incremental modes
File = $JOHN/eNtr0pY.chr
MinLen = 0
MaxLen = 31
CharCount = 95

Now it is time to use bruteforce attacks with our own charstet! :-D

./john --format=raw-md5-opencl --incremental=eNtr0pY ~/hashes/md5_1

If you look into john.conf you will see some bruteforce attack modes characterized as extrernals. These are Double, Strip, Keyboard (which uses neighbor combinations produced from keyboard characters), KnownForce, DateTime, Repeats, Sequence, Subsets and DumbForce for crazy password formats.

./john --format=raw-md5-opencl --external=DumbForce ~/hashes/md5_1

We would also like to crack double MD5 hashes with the help of script provided here.

perl < rockyou.txt | ./john --format=raw-md5-opencl --stdin ~/md5_1

Here you can see some samples of cracked md5s with John the Ripper:

Personally, I believe a password like “$MD5$0b26a0faf1344d6e772bf55628e10e29:n34=mn { .clipboard $me }” is impossible to crack with bruteforce attacks.

Note: All the abovementioned techniques can be used with oclHashcat-plus by defining -m 100 and with John the Ripper by defining –format=raw-sha1-opencl for SHA1 cracking with OpenCL!

Password Analysis

Finally, it worths to see an analysis using pipal (a password analyser) of a collected sample generated from cracking results.

root@m3g9tr0n:~/pipal$ ruby1.9.1 pipal.rb \
-o eNtr0pY_1 ~/Wordlists/Ultimate/Part1/eNtr0pY_5.dic
Total entries = 759103
Total unique entries = 758299

Top 10 passwords
niezgadniesz123 = 3 (0.0%)
ubqu = 3 (0.0%)
amonys = 3 (0.0%)
centralitie = 3 (0.0%)
bobydu = 3 (0.0%)
hanghuynh = 3 (0.0%)
hmadyousi = 3 (0.0%)
matthewperman = 3 (0.0%)
shadowninja2 = 3 (0.0%)
lhz4 = 3 (0.0%)

Top 10 base words
august = 219 (0.03%)
july = 205 (0.03%)
april = 199 (0.03%)
june = 195 (0.03%)
march = 165 (0.02%)
alex = 161 (0.02%)
love = 132 (0.02%)
chris = 130 (0.02%)
daniel = 128 (0.02%)
dragon = 122 (0.02%)

Password length (length ordered)
1 = 13 (0.0%)
2 = 103 (0.01%)
3 = 1332 (0.18%)
4 = 16781 (2.21%)
5 = 19831 (2.61%)
6 = 95800 (12.62%)
7 = 202414 (26.66%)
8 = 158562 (20.89%)
9 = 103855 (13.68%)
10 = 75652 (9.97%)
11 = 46023 (6.06%)
12 = 24997 (3.29%)
13 = 8423 (1.11%)
14 = 3772 (0.5%)
15 = 1560 (0.21%)

Password length (count ordered)
7 = 202414 (26.66%)
8 = 158562 (20.89%)
9 = 103855 (13.68%)
6 = 95800 (12.62%)
10 = 75652 (9.97%)
11 = 46023 (6.06%)
12 = 24997 (3.29%)
5 = 19831 (2.61%)
4 = 16781 (2.21%)
13 = 8423 (1.11%)
14 = 3772 (0.5%)
15 = 1560 (0.21%)
3 = 1332 (0.18%)
2 = 103 (0.01%)
1 = 13 (0.0%)


One to six characters = 133854 (17.63%)
One to eight characters = 494828 (65.19%)
More than eight characters = 264275 (34.81%)

Only lowercase alpha = 154996 (20.42%)
Only uppercase alpha = 14072 (1.85%)
Only alpha = 169068 (22.27%)
Only numeric = 119581 (15.75%)

First capital last symbol = 6088 (0.8%)
First capital last number = 73611 (9.7%)

january = 109 (0.01%)
february = 45 (0.01%)
march = 247 (0.03%)
april = 251 (0.03%)
may = 850 (0.11%)
june = 246 (0.03%)
july = 223 (0.03%)
august = 300 (0.04%)
september = 80 (0.01%)
october = 134 (0.02%)
november = 113 (0.01%)
december = 115 (0.02%)

monday = 59 (0.01%)
tuesday = 20 (0.0%)
wednesday = 7 (0.0%)
thursday = 38 (0.01%)
friday = 46 (0.01%)
saturday = 7 (0.0%)
sunday = 70 (0.01%)

Months (Abreviated)
jan = 1482 (0.2%)
feb = 249 (0.03%)
mar = 8397 (1.11%)
apr = 692 (0.09%)
may = 850 (0.11%)
jun = 889 (0.12%)
jul = 1051 (0.14%)
aug = 785 (0.1%)
sept = 215 (0.03%)
oct = 512 (0.07%)
nov = 821 (0.11%)
dec = 874 (0.12%)

Days (Abreviated)
mon = 4319 (0.57%)
tues = 28 (0.0%)
wed = 217 (0.03%)
thurs = 44 (0.01%)
fri = 758 (0.1%)
sat = 769 (0.1%)
sun = 1018 (0.13%)

Includes years
1975 = 411 (0.05%)
1976 = 388 (0.05%)
1977 = 446 (0.06%)
1978 = 432 (0.06%)
1979 = 441 (0.06%)
1980 = 541 (0.07%)
1981 = 453 (0.06%)
1982 = 519 (0.07%)
1983 = 533 (0.07%)
1984 = 603 (0.08%)
1985 = 585 (0.08%)
1986 = 616 (0.08%)
1987 = 710 (0.09%)
1988 = 641 (0.08%)
1989 = 941 (0.12%)
1990 = 931 (0.12%)
1991 = 995 (0.13%)
1992 = 935 (0.12%)
1993 = 905 (0.12%)
1994 = 907 (0.12%)
1995 = 4021 (0.53%)
1996 = 858 (0.11%)
1997 = 486 (0.06%)
1998 = 443 (0.06%)
1999 = 416 (0.05%)
2000 = 1024 (0.13%)
2001 = 643 (0.08%)
2002 = 586 (0.08%)
2003 = 1132 (0.15%)
2004 = 1254 (0.17%)
2005 = 796 (0.1%)
2006 = 818 (0.11%)
2007 = 1442 (0.19%)
2008 = 1019 (0.13%)
2009 = 742 (0.1%)
2010 = 767 (0.1%)
2011 = 516 (0.07%)
2012 = 925 (0.12%)
2013 = 165 (0.02%)
2014 = 142 (0.02%)
2015 = 146 (0.02%)
2016 = 118 (0.02%)
2017 = 139 (0.02%)
2018 = 131 (0.02%)
2019 = 172 (0.02%)
2020 = 179 (0.02%)
Years (Top 10)
1995 = 4021 (0.53%)
2007 = 1442 (0.19%)
2004 = 1254 (0.17%)
2003 = 1132 (0.15%)
2000 = 1024 (0.13%)
2008 = 1019 (0.13%)
1991 = 995 (0.13%)
1989 = 941 (0.12%)
1992 = 935 (0.12%)
1990 = 931 (0.12%)

black = 485 (0.06%)
blue = 549 (0.07%)
brown = 184 (0.02%)
gray = 89 (0.01%)
green = 348 (0.05%)
orange = 125 (0.02%)
pink = 262 (0.03%)
purple = 73 (0.01%)
red = 2974 (0.39%)
white = 179 (0.02%)
yellow = 85 (0.01%)
violet = 63 (0.01%)
indigo = 22 (0.0%)

Single digit on the end = 92080 (12.13%)
Two digits on the end = 87587 (11.54%)
Three digits on the end = 103715 (13.66%)

Last number
0 = 45407 (5.98%)
1 = 64764 (8.53%)
2 = 52570 (6.93%)
3 = 52890 (6.97%)
4 = 43719 (5.76%)
5 = 55185 (7.27%)
6 = 42826 (5.64%)
7 = 46169 (6.08%)
8 = 42475 (5.6%)
9 = 44930 (5.92%)

 | | |                                                                  
 ||| |                                                                  
|||| | | |                                                              

Last digit
1 = 64764 (8.53%)
5 = 55185 (7.27%)
3 = 52890 (6.97%)
2 = 52570 (6.93%)
7 = 46169 (6.08%)
0 = 45407 (5.98%)
9 = 44930 (5.92%)
4 = 43719 (5.76%)
6 = 42826 (5.64%)
8 = 42475 (5.6%)

Last 2 digits (Top 10)
95 = 14675 (1.93%)
23 = 12192 (1.61%)
12 = 9230 (1.22%)
11 = 8214 (1.08%)
01 = 7606 (1.0%)
00 = 7131 (0.94%)
07 = 6295 (0.83%)
10 = 6182 (0.81%)
21 = 5881 (0.77%)
99 = 5868 (0.77%)

Last 3 digits (Top 10)
123 = 6857 (0.9%)
995 = 4122 (0.54%)
971 = 2916 (0.38%)
972 = 2850 (0.38%)
007 = 2514 (0.33%)
000 = 1868 (0.25%)
234 = 1725 (0.23%)
666 = 1465 (0.19%)
777 = 1389 (0.18%)
004 = 1347 (0.18%)

Last 4 digits (Top 10)
1995 = 3886 (0.51%)
1234 = 1379 (0.18%)
2007 = 1325 (0.17%)
2004 = 1121 (0.15%)
2003 = 1016 (0.13%)
2008 = 869 (0.11%)
2000 = 846 (0.11%)
1991 = 819 (0.11%)
2012 = 809 (0.11%)
1990 = 789 (0.1%)

Last 5 digits (Top 10)
12345 = 743 (0.1%)
23456 = 652 (0.09%)
54321 = 189 (0.02%)
23123 = 140 (0.02%)
56789 = 127 (0.02%)
34567 = 102 (0.01%)
11111 = 99 (0.01%)
45678 = 75 (0.01%)
00000 = 73 (0.01%)
88888 = 68 (0.01%)

US Area Codes
971 = Oregon:  Metropolitan Portland,
               Salem/Keizer area,
               incl Cricket Wireless (OR)
972 = Texas: Dallas Metro (TX)
234 = NE Ohio: Canton, Akron (OH)

Character sets
loweralphanum: 330937 (43.6%)
loweralpha: 154996 (20.42%)
numeric: 119581 (15.75%)
mixedalphanum: 41121 (5.42%)
upperalphanum: 41078 (5.41%)
mixedalpha: 28464 (3.75%)
upperalpha: 14072 (1.85%)
loweralphaspecial: 10222 (1.35%)
loweralphaspecialnum: 5735 (0.76%)
mixedalphaspecial: 4724 (0.62%)
upperalphaspecial: 2939 (0.39%)
mixedalphaspecialnum: 2247 (0.3%)
specialnum: 648 (0.09%)
upperalphaspecialnum: 374 (0.05%)
special: 47 (0.01%)

Character set ordering
stringdigit: 349534 (46.05%)
allstring: 197532 (26.02%)
alldigit: 119581 (15.75%)
digitstring: 28873 (3.8%)
othermask: 18649 (2.46%)
stringdigitstring: 14577 (1.92%)
stringspecial: 10441 (1.38%)
digitstringdigit: 9981 (1.31%)
stringspecialstring: 5469 (0.72%)
stringspecialdigit: 3075 (0.41%)
specialstring: 834 (0.11%)
specialstringspecial: 510 (0.07%)
allspecial: 47 (0.01%)

Hashcat masks (Top 10)
?d?d?d?d?d?d?d: 85053 (11.2%)
?l?l?l?l?l?l: 38400 (5.06%)
?l?l?l?l?l?l?l?l: 36217 (4.77%)
?l?l?l?l?l?l?l: 35468 (4.67%)
?l?l?l?l?l?l?d?d?d: 24051 (3.17%)
?l?l?l?l?l?l?d?d: 18591 (2.45%)
?l?l?l?l?l?d?d?d: 18047 (2.38%)
?d?d?d?d?d?d: 16048 (2.11%)
?l?l?l?l?l?l?l?l?l: 14236 (1.88%)
?l?l?l?l?d?d?d: 13802 (1.82%)


This was a very time consuming and hard job because I do not own the fastest card. The whole cracking process took about 5 months to accomplish because I had to finish my studies about CCNP certification. The lesson learned from this is that with a good and smart dictionary combined with handy rules either for hashcat or John the Ripper even strong passwords can be cracked. Based on the upon statement, admins should use a stronger hash algorithm (with salt) to store your passwords or even better from your side just change your passwords in a regular basis. ;-)

Thanks for reading. :-)
You can find me on twitter, @m3g9tr0n.


You can download the results of cracked hashes:
Version: 1.0
721.9 MB

The provided KoreLogic torrent file contains various but unique password hashes. For that reason you may find duplicated passwords in these wordlists, as a single password can be hashed using various algorithmes! Meaning that 122 million unique hashes (MD5, SHA1, double MD5, etc.) were cracked and result in 83,6 million unique passwords.

You can download the “all in one” version, cleaned and sorted:
Version: 1.0
270.2 MB

The command used to generate this “all in one” CLEANED wordlist was:

export LC_ALL='C' && cat * | sort | uniq > eNtr0pY_ALL_sort_uniq.dic


Incoming search terms:

33 Comments :, , , , , , , , , , , , , , , , , , , , , , , , , , , , more...

[GUIDE] HackinTosh – Install MacOS Mountain Lion 10.8 to 10.8.5 on Asus SaberTooth P67 in 3 STEPS

by on Aug.19, 2012, under Guides and tutorials,  Hack1nT0sh,  MacOS. 0 views

How to build a HackinTosh with Mountain Lion (10.8), the latest version of MacOS X.

During this very hot summer (about 37°C outside), I spent about 20 hours in an entire weekend to install MacOS 10.8 Mountain Lion on my Asus Sabertooth P67. Really, there’s no best time for that… And because I love you my readers, I wrote this little GUIDE in the hope you’ll find useful information in it.

This article will be updated continuously. So come back here time to time or follow me on twitter! :-)

What’s not working:

  • Nothing

Updates: (subscribe to my twitter to get notified)

  • 08/20/2012 – ExtraThi updated to v1.1! (ExtraThi v1.0 was broken)
  • 08/20/2012 – Added USB 3.0 support explanations in STEP #3.
  • 08/23/2012 – Updated information relative to Extensions.mkext creation.
  • 08/23/2012 – Original ExtraThi_v1.1 renamed to ExtraThi_v1.1_10.8.
  • 08/23/2012 – 10.8.1 update procedure with ExtraThi_v1.1_10.8.1.
  • 08/23/2012 – Chameleon 2.1 r2048 replaced by r2050.
  • 08/24/2012 – 10.8.1 update procedure [ TESTING… ] -> [ GOOD ]
  • 09/22/2012 – Fixed a mistake in AppleGraphicsPowerManagement.kext plist modification (IOCFUnserialize: syntax error near line 2995). Please download the new kext or apply the new modifications!
  • 09/22/2012 – Chameleon 2.1 r2050 replaced by r2060.
  • 09/22/2012 – 10.8.2 update procedure [ GOOD ]
  • 01/11/2013 – Minor changes.
  • 01/11/2013 – USB 3.0 working, added a note about it for SaberTooth P67 users.
  • 03/18/2013 – Chameleon 2.1 r2060 replaced by Chameleon 2.2 r2187.
  • 03/18/2013 – iMessage fix with FileNVRAM from xZeneu LLC.
  • 03/18/2013 – New version of AGPM.kext for MacOS X 10.8.3.
  • 03/18/2013 – 10.8.3 update procedure [ TESTING… ] -> [ GOOD ]
  • 03/18/2013 – Minor changes.
  • 03/29/2013 – Fixed a mistake in AppleGraphicsPowerManagement.kext plist modification for 10.8.3. Please download the new kext!
  • 05/04/2013 – New Audio kext instructions, which fix “With DSDT” Audio kext issues under 10.8.3. (MultiBeast has been updated with new audio kexts: Updated toleda’s patched AppleHDAs to the 10.8.3 versions)
  • 05/04/2013 – USB 3.0 support is now UNIVERSAL! New USB 3.0 Instructions. (Make sure to delete any CalDigit*.kext and PXHCD.kext drivers from your /System/Library/Extensions folder). Fix USB 3.0 not properly working under 10.8.3. You should now use RehabMan’s branch of Zenith432’s GenericUSBXHCI.kext to enable USB 3.0.
  • 05/04/2013 – ExtraThi updated to v1.2! (New Preboot image with new additional and updated kexts. Thanks to Artistus!)
  • 06/07/2013 – 10.8.4 update procedure [ GOOD ]
  • 06/07/2013 – Chameleon 2.2 r2187 replaced by Chameleon 2.2 r2189.
  • 09/21/2013 – Chameleon 2.2 r2189 replaced by Chameleon 2.2 r2263.
  • 09/21/2013 – ExtraThi updated to v1.3! (New fakesmc.kext + plugins 5.3.832 from kozlek)
  • 09/21/2013 – 10.8.5 update procedure [ GOOD ]
  • 11/04/2013 – Chameleon 2.2 r2263 replaced by Chameleon 2.2 r2266.
  • 11/04/2013 – AppleIntelE1000e.kext, you should roll back to v2.4.14.
  • 11/04/2013 – 10.8.5 Supplemental Update 1.0 PROCEDURE [ GOOD ]
  • 16/03/2014 – SAPPHIRE ATI Radeon HD6870 multiple output (4 PORT dvi/hdmi) fix.


  • Better AGPM.kext for NVIDIA GTX 480 to avoid lags of 1st speedstep layer. (in fact the plist modification was broken due to syntax error… so the kext was not loaded! :-/ It is now fixed!)
  • Extra checks regarding STEP #3 additional kexts.
  • Better patch for AppleIntelCPUPowerManagement (boot kext mode) so it can be added to Extensions.mkext and will not require to be removed from /S/L/E.
  • Test betstu settings for AGPM.kext GTX480 iMac12,2 10.8

Before we start…

This is not an universal/generic GUIDE. All tips, files and patches provided in this article are designed to work for my own computer specs. In the meantime, I think people with a similar configuration will find this guide interesting and useful to achieve their installation of MacOS X Mountain Lion.

This guide was not made for beginners, also if you have any questions, I recommend you to ask on various HackinTosh forum communities before, such as tonymacx86 or InsanelyMac.

About my specs

Let’s see what we have here…

  • CPU: Intel – Processeur – Intel Core i7 2600K / 3,4 GHz – LGA1155 Socket – L3 8 Mo
  • RAM: G.Skill Kit Extreme3 4 x 4 Go PC15000 Sniper CAS 9
  • MotherBoard: ASUS SABERTOOTH P67 (rev. B3) – Socket 1155 – Chipset P67 – ATX – BIOS VERSION 2302 official*
  • GPU: SAPPHIRE ATI Radeon HD6870 Toxic | 1024 Mo DDR5 – PCI Express – DUAL DVI / HDMI / mini DP
  • GPU: ASUS ENGTX480/2DI/1536MD5 GeForce GTX 480 (Fermi) 1536MB 384-bit GDDR5 PCI Express 2.0 x16 HDCP Ready SLI Support Video Card
  • Power Supply: OCZ Z Series Gold OCZZ1000M 1000W
  • Case: Lian Li PC-K63

* Some people reported issues with SATA controller for the latest 3302 version (link). Do not upgrade your BIOS unless you know what you’re doing. By the way, it is possible to patch your BIOS to avoid some issues with MacOS, such as AppleIntelCPUPowerManagement problems related to Intel SpeedStep

 What do you need

Basically it is better to already have a working version of MacOS installed on your HackinTosh. It is always possible to achieve all steps of this GUIDE with an external MacOS system, but it will be more difficult. Also, I recommend you to have the following stuffs:

  • 1 x USB/SD card of 8GB minimum.
  • 1 x Original Mountain Lion Install DVD (InstallESD.dmg, md5 checksum = 8b4869920cd740414fe6b7e3f0b1be3e).
  • 8GB of available space minimum to install Mountain Lion.
  • 1 x Human Brain.
  • 30 minutes up to 3 hours spare time.

 HackinTosh common issues… Warning!

In case some of you might think dealing with a HackinTosh is quite easy, here is a quick list of common issues you can face while attempting to build your HackinTosh. These issues CAN ALSO be faced after every OS X update!

  • Speedstep not working, which causes Kernel Panic at startup (related to AppleIntelCPUPowerManagement.kext).
  • SATA controller not working properly.
  • Some ACPI tables not recognized (in this case you have to deal with DSDT or/and SSDT).
  • Graphics cards not natively supported can lead to Kernel Panics, bad power management (altered performances), black/blank screens, freezes, video output not recognized (DVI/HMDI/VGA), etc.
  • USB not recognized, including both USB 2.0 and 3.0.
  • Network cards not working or stuck at a certain speed.
  • Audio output/input not working.
  • Sleep/Wake/Reboot not working.

Most of these issues can be solved by patching Apple drivers, or installing custom drivers. Some of them, such as DSDT and SSDT tables require advanced knowledge and hacks.

STEP 1 – Creating USB/SD Mountain Lion Installation Drive

For this part, you need to force Finder to show all hidden files (link).

  1. Right Click “Install OS X Mountain Lion” -> Show Package Contents.
  2. Contents -> Shared Support -> InstallESD.dmg.
  3. Open InstallESD.dmg (this will popup the “Mac OS X Install ESD” volume).
  4. In “Mac OS X Install ESD” volume open BaseSystem.dmg (this will popup the “Mac OS X Base System” volume).
  5. Open the Disk Utility application.

Now we will create our USB/SD Mountain Lion installation DVD volume.

  1. Partition your USB/SD device to match two partition, GUID Partition Scheme, both must be Mac OS Extended (Journaled).
  2. The first partition must be around 500MB, and the second one the remaining free space.
  3. Call the first partition CHAMELEON (500MB), and the second one INSTALLDVD (more than 6GB).
  4. Restore “Mac OS X Base System” volume (source) to INSTALLDVD (desination).
  5. Once done, your INSTALLDVD partition should now popup with the name Mac OS X Base System.
  6. Replace “Mac OS X Base System“/System/Installation/Packages (must be removed) by “Mac OS X Install ESD”/Packages (copy/paste)*
  7. Mac OS X Base System” is now your installation DVD volume.

* A more detailed and illustrated guide about this process can be found on this link.

At the end, this is how your USB/SD drive should look like:

Now we must create the bootloader.

  1. Download Chameleon 2.2 r2266 or newer version (from source or package).
  2. Install Chameleon on your CHAMELEON volume (default install, no extra options checked).
  3. Open CHAMELEON, unzip and copy the following Extra folder into it:
Version: 1.1_10.8
54.9 MB

In this Extra folder you will find:

  • DSDT.aml/dsl files are specific to ASUS Sabertooth P67 AND Intel Core i7-2600k! If you have a different configuration you can create and patch your own DSDT, or you can find pre-patched DSDT on this database.
  • SSDT patches for CPU Speedstep have been directly integrated to DSDT (ASUS motherboards does not deal with SSDT for that). If you have a different configuration other than ASUS Sabertooth P67 AND Intel Core i7-2600k, YOU MUST follow these instructions to create your own SSDT or find some help in this forum. If you do not create any SSDT file or patch your DSDT file (for your custom configuration) you will be stuck at some CPU speed (16x for example).
  • Preboot.dmg contains all generic kexts you need to boot, including patched AppleIntelCPUPowerManagement.kext. It also contains the Darwin kernel (12.0.0) for MacOS X 10.8. This Preboot.dmg image should be generic but is dependent of the OS X version.
  • Other files are generic and related to Chameleon configuration.

Once done, eject your drive and boot your computer with it. Chameleon should display a list of bootable drives, you must select “Mac OS X Base System“.

STEP 2 – Install MacOS X Mountain Lion 10.8

Boot your “Mac OS X Base System” drive (which is Mountain Lion Installation DVD) in verbose mode (-v).

Now comes the hard part :-) . If you are lucky enough and if you use the same configuration as me, Mountain Lion Installation DVD will load without any issues. If not, issues can be related to the ones listed in the HackinTosh common issues… Warning! section of this GUIDE. Most issues can be related to your Graphic Card and can be solved with some tricks like GraphicsEnabler=Yes/No. For this reason, I will not list here all issues and solutions, it really depends of your Graphic Card model. By the way, if you plan to buy a new Graphic Card, I recommend you to have a look at this list and buy a “Working Out Of the Box” Graphic Card.

Some people are facing an issue with ATI/AMD Graphics Cards, when the Installation DVD is loaded they see a blank screen and their mouse but nothing else. To fix this issue you have two solutions.

  1. You can press the power button to make your computer sleep, and then press the power button again to wake it. Once awoken you should see the normal Installation screen and no more blank screen. This works only if you have sleep/wake working. It was working for me with my ATI Radeon HD6870 Toxic. :-)
  2. According to this topic, you can delete/backup ATI6000controller.kext which is located in your “Mac OS X Base System“/System/Library/Extensions folder. This step is only for the installation process. Once on Mountain Lion you must put this file back in your /System/Library/Extensions folder.

In case everything works well, you must be able to install Mountain Lion.

RAID0 (optional part)

Those who don’t want to use RAID0 might find this tip useful too, because this tip provide an easy way to backup the Extensions.mkext file to prevent any stuck OS. For example, if you install a bad kext in your /System/Library/Extensions folder that crashes your OS on the next boot, you can easily rollback to one of your previous Extensions.mkext files which does not contain this bad kext ;-)

If you want to install Mountain Lion on a RAID0 software partition you’ll also be interested to read my old post regarding RAID 0 Apple Software + x86_64 kernel + GUID + Dual Boot Seven. Note that if you are planing to install your OS on a RAID0 partition it is way better to have an external chameleon bootloader (located on another drive), because you will face a big issue regarding kexts. Chameleon will not be able to access your RAID0 drive to load Extensions.mkext nor extensions located in the /System/Library/Extensions folder (in case you try to boot without cache -f). For this reason, you need to create the Extensions.mkext cache file in your Chameleon Extra folder BEFORE you try to boot Mountain Lion and AFTER any changes in your /System/Library/Extensions folder. YOU SHOULD FIRST DELETE AppleIntelCPUPowerManagement.kext from your /System/Library/Extensions folder!

Use the following commands everytime you update your OS or update your Extensions folder:

mv /Volumes/CHAMELEON/Extra/Extensions.mkext /Volumes/CHAMELEON/Extra/Extensions.mkext.bak
cd /Volumes/CHAMELEON/Extra/
sudo kextcache -v -l -m Extensions.mkext /System/Library/Extensions

If you have multiple Extensions folders:

mv /Volumes/CHAMELEON/Extra/Extensions.mkext /Volumes/CHAMELEON/Extra/Extensions.mkext.bak
cd /Volumes/CHAMELEON/Extra/
sudo kextcache -v -l -m Extensions.mkext /Extra/Extensions ... /System/Library/Extensions ... /AndAnyOtherFolderContainingkexts

STEP 3 – Boot Mountain Lion 10.8 and install additional kexts

Use your Chameleon USB/SD drive to boot Mountain Lion. When the list of bootable OS popup you just have to choose the name of the OS X partition where you have installed Mountain Lion. Once done… Welcome in Mountain Lion :-)

YOU SHOULD FIRST DELETE AppleIntelCPUPowerManagement.kext from your /System/Library/Extensions folder!

You might want to do is install Chameleon Bootloader to get rid of your USB/SD bootable device. Follow once again the steps to install Chameleon with Extra folder, but this time either select your Mountain Lion partition or another bootable device (if you have installed OSX on a Raid0 partition I recommend you the second option). Then in your BIOS, change settings to boot on the drive where you have installed Chameleon! ;-)

About additional kexts…

Audio, USB 3.0 and Ethernet drivers can be found in MultiBeast – Mountain Lion. The reason why I prefer not to use such tools for a fresh install is because most of the time we don’t know what exactly these applications install. So I prefer creating my own bootloader with my own kexts, which is better in case you need to debug your bootloader.

  • Audio* – If you use my DSDT you must select ALC892 from the “Drivers & Bootloaders -> Drivers -> Audio -> Realtek ALC8xx -> With/Without DSDT” section (use ‘Without DSDT’ if you have not patched your DSDT). Otherwise, you must select the audio driver for your own configuration in case Audio does not work out of the box.
  • USB 3.0 – Install USB 3.0 – Universal from the “Drivers & Bootloaders -> Drivers -> Miscellaneous” section. Make sure you do not have any CalDigit*.kext and PXHCD.kext drivers from your /System/Library/Extensions folder, otherwise you must delete them (and rebuild your cache).
  • Ethernet* – Install hnak’s AppleIntelE1000e Ethernet (from MultiBeast – Mountain Lion) or AppleIntelE1000e.kext (I prefer this method). It is strongly advised to use the stable 2.4.14 version of this kext. Newest versions are very unstable after hours of heavy network usage (i.e. 2.5.4d). This issue has been reported on the official forum topic: here.
Version: 2.4.14
124.3 KB

* Note that these drivers depend of your motherboard!

Before each reboot make sure to Repair Permissions with Disk Utility.

Hopefully my NVIDIA GTX 480 and AMD HD6870 Graphics Cards were working out of the box on Mountain Lion. OpenCL, OpenGL and Quartz Extreme are working without any patch :-) . In case you need to patch OpenCL you’ll find more information on this topic. The only issue I faced on Mountain Lion was bad GPU power management of my NVIDIA GTX 480. To fix this issue you need to patch the Infos.plist file contained in the AppleGraphicsPowerManagement.kext folder.

Here are the lines you need to add, right after <key>iMac12,2</key> <dict>. This patch only works for iMac12,2 model and NVIDIA GTX 480! Also be careful when copy/paste, you may need to replace inadequate spaces with tabs… Prefer the pre-patched version if you are unsure!


If you still need the full kext, here it is:

AGPM.kext GTX480 iMac12,2 10.8 [FIXED!]
AGPM.kext GTX480 iMac12,2 10.8 [FIXED!]
Version: 1.1
44.4 KB

IF YOU ARE UNDER 10.8.3 YOU NEED THIS VERSION OF THE KEXT (you can still patch the original kext manually):

AGPM.kext GTX480 iMac12,2 10.8.3+ ONLY [v1.2]
AGPM.kext GTX480 iMac12,2 10.8.3+ ONLY [v1.2]
Version: 1.2
46.3 KB

About iMessage…

HackinTosh computers may have this bad behavior with iMessage, that when you try to sign in to iMessage it fails with an error displaying “Could not sign in to iMessage.“. Fortunately ‘xZeneu LLC‘ released a module for Chameleon r2181 or newer named FileNVRAM.dylib that fixes this issue (download the 1.1.3 version or newer). Make sure that you have the latest version of Chameleon and put the FileNVRAM.dylib module to your /Extra/modules/ folder. Reboot and enjoy iMessage. :-)

Final thoughts…

I’m writing these last lines from my new Mountain Lion OS :-) . I hope you enjoyed this tutorial. Feel free to thank anyone who helped you in this painful task. :-)
Never forget that this hard work was made during spare time and if you need help you’d better ask on hackintosh forums, such as tonymacx86 or InsanelyMac.

And as always, feel free to share the knowledge my friends!

OSX Updates:

10.8.1 UPDATE PROCEDURE [ GOOD ] – Update, reboot, enjoy!

  1. Eitheir update from App Store or direct link.
  2. Use the following updated ExtraThi_v1.1 to boot Mountain Lion, it contains the new OS X Darwin kernel (12.1.0 for MacOS 10.8.1) included in Preboot.dmg.
  3. (Optional) Users who have installed Chameleon 2.1 r2048 (previous version of this GUIDE) can upgrade their CHAMELEON bootloader with Chameleon 2.1 r2050 (from source or package).
Version: 1.1_10.8.1
50.1 MB

10.8.2 UPDATE PROCEDURE [ GOOD ] – Update, reboot, enjoy!

  1. Eitheir update from App Store or direct link.
  2. Use the following updated ExtraThi_v1.1 to boot Mountain Lion, it contains the new OS X Darwin kernel (12.2.0 for MacOS 10.8.2) included in Preboot.dmg.
  3. (Optional) Users who have installed Chameleon 2.1 r2050 (previous version of this GUIDE) can upgrade their CHAMELEON bootloader with Chameleon 2.1 r2060 (from source or package).
Version: 1.1_10.8.2
50.1 MB

10.8.3 UPDATE PROCEDURE [ GOOD ] – Update, patch, reboot, enjoy!

  1. Update using the OS X Mountain Lion Update v10.8.3 (Combo) from direct link.
  2. Patch your AppleGraphicsPowerManagement.kext if needed (Apple updated this kext in this 10.8.3 version, so you need to patch it again).
  3. Use the following updated ExtraThi_v1.1 to boot Mountain Lion, it contains the new OS X Darwin kernel (12.3.0 for MacOS 10.8.3) included in Preboot.dmg.
  4. Users who have installed Chameleon 2.1 r2060 (previous version of this GUIDE) must upgrade their CHAMELEON bootloader with Chameleon 2.2 r2187 or newer version (from source or package).
  5. Apply fixes for Audio/USB3.0/Ethernet/iMessage/etc.
Version: 1.2_10.8.3
38.7 MB

10.8.4 UPDATE PROCEDURE [ GOOD ] – Update, patch, reboot, enjoy!

  1. Update using the OS X Mountain Lion Update v10.8.4 (Combo) from direct link.
  2. Patch your AppleGraphicsPowerManagement.kext if needed (Apple updated this kext in 10.8.3 version, so you need to patch it again if updating via Combo).
  3. Use the following updated ExtraThi_v1.2.1 to boot Mountain Lion, it contains the new OS X Darwin kernel (12.4.0 for MacOS 10.8.4) included in Preboot.dmg.
  4. Users who have installed Chameleon 2.1 r2187 (previous version of this GUIDE) should upgrade their CHAMELEON bootloader with Chameleon 2.2 r2189 or newer version (from source or package).
  5. Apply fixes for Audio/USB3.0/Ethernet/iMessage/etc.
Version: 1.2.1_10.8.4
38.5 MB

10.8.5 UPDATE PROCEDURE [ GOOD ] – Update, patch, reboot, enjoy!

  1. Update using the OS X Mountain Lion Update v10.8.5 (Combo) from direct link.
  2. Patch your AppleGraphicsPowerManagement.kext if needed (Apple updated this kext in 10.8.3 version, so you need to patch it again if updating via Combo).
  3. Use the following updated ExtraThi_v1.3 to boot Mountain Lion, it contains the new OS X Darwin kernel (12.5.0 for MacOS 10.8.5) included in Preboot.dmg.
  4. Users who have installed Chameleon 2.2 r2189 (previous version of this GUIDE) should upgrade their CHAMELEON bootloader with Chameleon 2.2 r2266 or newer version (from source or package).
  5. Apply fixes for Audio/USB3.0/Ethernet/iMessage/etc.
Version: 1.3_10.8.5
34.1 MB

10.8.5 Supplemental Update 1.0 PROCEDURE [ GOOD ] – Update, patch, reboot, enjoy!

  1. Update using the OS X Mountain Lion v10.8.5 Supplemental Update 1.0 from direct link.
  2. Patch your AppleGraphicsPowerManagement.kext if needed (Apple updated this kext in 10.8.3 version, so you need to patch it again if updating via Combo).
  3. Use the following updated ExtraThi_v1.3.1 to boot Mountain Lion, it contains the new OS X Darwin kernel (12.5.0 for MacOS 10.8.5) included in Preboot.dmg.
  4. Users who have installed Chameleon 2.2 r2263 (previous version of this GUIDE) should upgrade their CHAMELEON bootloader with Chameleon 2.2 r2266 or newer version (from source or package).
  5. Apply fixes for Audio/USB3.0/Ethernet/iMessage/etc.
  6. For Ethernet, you should consider using AppleIntelE1000e.kext v2.4.14
  7. SAPPHIRE HD 6870 4 PORT kext 10.8.5 patched – Install the patched ATI6000Controller.kext (replace the original one provided by Apple) to fix DVI/HDMI outputs of your Sapphire HD6870 Graphics Card. With the original ATI6000Controller.kext only one DVI output is working out of the box.
Version: 1.3.1_10.8.5
33.6 MB

Please note that after each update Audio/USB3.0/Ethernet/etc. might be broken. Make sure to fix them right after the update.

RAID0 users: After each update do not forget to rebuild your Extensions.mkext!

Incoming search terms:

109 Comments :, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , more...

Page 1 of 212

Thireus on Twitter