Identifying router keyspace or mask used in known passwords

[rocky45]

Hello.
I have a bunch of known passwords for TP-Link TD-W8963N routers with a fixed length of 10 characters (loweralphanum).
I was wondering if someone can extract a pattern or make a key generator for these?
Using a 10length ?l?d charset on hashcat will take 900 years on my hardware (and any other computer obviously).
MAC addresses are 34:E8:94:* or C4:71:54:*.

Here's the list:

rtkoc4989k
owgpue160h
vbbdtdt3rl
xiqgk2h8eg
mzq9x411p4
vg0bmmr1y9
gen8izg8az
21313067bb
jqq0sku0cl
mxmpczkz4l
cdinawy7t2
ojna92z0pq
7fwfemi97b
lap2w258mo
2c2e8ef48o
9oedkux9u4
fe4vtgi1my
rqdoipj6sc
cizdbiv30a
edb4bqh4f9
uo93p3m56c
jgr8smt481
yj2n82y7pa
bt2ftm35bl
un6phk27tn
6gt3v113i0
nqecd44337
vvfgi4z67h
azertyuiop
rtkoc4989k
owgpue160h
vbbdtdt3rl
dqrad8ht91
xiqgk2h8eg
0umshc28a6
fsi0uz8ygk
kyhsarc8od
frkct388hh
vfras0605f
uhk8lsc0t9
jcphg73887
wbjgx49399
4pmu9a18fd
voyoott4kg
x5dca2jdzi
oo7twh2u4y
v7bmntj0n3
zvbbfc9wse

 

[rocky45]

"21313067bb" is a custom password, just ignore it.

 

[nobodyinparticular]

With a python script you can determine some kind of keyspace by extracting recurring letters per-line, line in this case:
1st Letter: 2279bccefgjjlmmoorruuvvxy
2nd Letter: 1abcddeefggiijjnooqqttwxz
3rd Letter: 02223469bbdegikmnnpqqqrwz
4th Letter: 01234889abdddeffgnnoopppv
5th Letter: 3889abbccehiikkmpsstttuwx
6th Letter: 02222344deegikkmmmmpquwzz
7th Letter: 1123569fghhiijkmrttuvxyyz
8th Letter: 001113344455667777888899z
9th Letter: 00467889abbcefmmppprsttuy
10th Letter: 124499aabbccghkllllnooqyz

To further refine you can add to the script a function to remove duplicates, and this should give you some idea for a keyspace to employ in your attack I guess. Of course, hashcat does not allow for more than 4 masks, so you will need to read up on hashcat to determine an appopriate strategy.

This isn't always efficient, although it can be, and certainly not as efficient as an algorithm or a mathematical function. The script is essentially spaghetti code but you are free to rewrite it as you should understand the idea now...


#!/usr/bin/env python3
#recurrence py

with open("/home/me/Desktop/passwords",'r') as passw:
__vpass1 = []; vpass2 etc..
__for lines in passw:
___vpass1.append(lines[:1])
___vpass2.append(lines[1:2])
___etc..
vpass1 = "".join(sorted(vpass1))
vpass2 = "".join(sorted(vpass2))
etc..
a= open("/home/me/Desktop/recurrence.txt", 'w+')
a.write("1st Letter: " + str(vpass1)+"\n")
a.write("2nd Letter: " + str(vpass2)+"\n")
etc..