hashcat Forum

I seem to be having an issue with cracking some of my NTLM hashes.

Currently I have dumped a 2008R2 SAM using VSS in combination with QwarksPWDump util to get it into a txt file.

They appear like this example:

I have removed:

Leaving me with what I think is the NTLM:

I use the following command:

I am unable to crack any of the passwords even though I have set my own password in AD manually and placed it in the wordlist.txt I did add in the example hashcat NTLM and it was able to retrieve it fine. I dont get any errors either about line length.

My impression is that the export is suspect. Any ideas?

It was my own fault for not reading the documentation on QwarksPWDump

http://blog.quarkslab.com/quarks-pwdump.html

"For example, it's not possible to parse Win 2008 NTDS.dit file from XP. In fact, record's checksum are computed in a different manner and database files appear corrupted for API functions."

I just dumped the hashes on using the utility on Windows 7 not on the DC itself, running the same application against the same hash files over Win7, server 2008R2 , and Server 2012R2 gave all different hashes.