hashcat Forum

Full Version: Question About NTLM
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
I've been doing a lot of research into how the NTLM hash works, according to https://asecuritysite.com/encryption/lmhash an NTLM hash is ASCII input > UNICODE > MD4 Hash.

I don't quite get how this works, also I think his example was messed up.  Anyway, could someone explain it to me or provide a site that can, please.
It's exactly as you said.

Code:
root@ht:~/hashcat# echo -n password | iconv -f utf8 -t utf16le | openssl dgst -md4
(stdin)= 8846f7eaee8fb117ad06bdd830b7586c
(10-05-2016, 12:48 PM)atom Wrote: [ -> ]It's exactly as you said.

Code:
root@ht:~/hashcat# echo -n password | iconv -f utf8 -t utf16le | openssl dgst -md4
(stdin)= 8846f7eaee8fb117ad06bdd830b7586c

Ok, I was more wondering how does the password get converted to unicode before its hashed, like...

hello --unicode--> 00680065006c006c006f --MD4--> c086551358a173bab054b4d5d694737f

but that isn't right,

hello --NTLM--> 066ddfd4ef0e9cd7c256fe77191ef43c

so how could I convert it to just the unicode so I could hash it using MD4?
The NTLM kernel does that automatically for you
(10-06-2016, 05:51 PM)atom Wrote: [ -> ]The NTLM kernel does that automatically for you

I realize that, but I want to know how would I convert it to the correct unicode form myself.  Is there a website that can or a program I can use to convert a string to the correct unicode form.
(10-05-2016, 12:48 PM)atom Wrote: [ -> ]It's exactly as you said.

Code:
root@ht:~/hashcat# echo -n password | iconv -f utf8 -t utf16le | openssl dgst -md4
(stdin)= 8846f7eaee8fb117ad06bdd830b7586c

(10-06-2016, 06:35 PM)will2238 Wrote: [ -> ]
(10-06-2016, 05:51 PM)atom Wrote: [ -> ]The NTLM kernel does that automatically for you

I realize that, but I want to know how would I convert it to the correct unicode form myself.  Is there a website that can or a program I can use to convert a string to the correct unicode form.
Your unicode byte order is simply backwards.  it should be 680065006c00 and so on...


(10-05-2016, 06:48 PM)will2238 Wrote: [ -> ]
(10-05-2016, 12:48 PM)atom Wrote: [ -> ]It's exactly as you said.

Code:
root@ht:~/hashcat# echo -n password | iconv -f utf8 -t utf16le | openssl dgst -md4
(stdin)= 8846f7eaee8fb117ad06bdd830b7586c

Ok, I was more wondering how does the password get converted to unicode before its hashed, like...

hello --unicode--> 00680065006c006c006f --MD4--> c086551358a173bab054b4d5d694737f

but that isn't right,

hello --NTLM--> 066ddfd4ef0e9cd7c256fe77191ef43c

so how could I convert it to just the unicode so I could hash it using MD4?
Maybe this makes it more clear:

Code:
root@ht:~/hashcat# echo -n password | iconv -f utf8 -t utf16le |  xxd  
00000000: 7000 6100 7300 7300 7700 6f00 7200 6400  p.a.s.s.w.o.r.d.
root@ht:~/hashcat# echo -n password | iconv -f utf8 -t utf16le |  openssl dgst -md4
(stdin)= 8846f7eaee8fb117ad06bdd830b7586c