Cracking Windows hashes
Cracking operations on Windows hashes depend significantly on the hashes that are observed, and this is most easily supported by hashcat. The modes vary, depending on the type of hash involved. They are listed here:
- LANMAN hashes: Mode 3000
- NTLM hashes: Mode 1000
- Netntlmv1: Mode 27000
- Netntlmv2: Mode 27100
- Kerberos: Varies
The best way to ensure your hashcat hash is formatted properly is to check the hashcat example hashes page at https://hashcat.net/wiki/doku.php?id=example_hashes.
After formatting your hash, pass it to hashcat with the proper attack mode and hash type, along with your wordlist or mask as appropriate. The following example syntax is for ntlm, hash mode 3000:
hashcat -m 3000 -a 0 ntlm.hash rockyou.txt
Remember that, due to their relatively simple construction, LANMAN and NTLM hashes may not need to be cracked and may be able to be looked up, especially since these hashes are not salted. One resource for...
