hashcat Forum
NetNTLMv1 format - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Ancient Versions (https://hashcat.net/forum/forum-46.html)
+--- Forum: Very old oclHashcat-plus Support (https://hashcat.net/forum/forum-23.html)
+--- Thread: NetNTLMv1 format (/thread-2298.html)



NetNTLMv1 format - mastercracker - 05-16-2013

Hi. I was trying to crack a NetNTLMv1 hash and tried a lot of different hash formats but was not able to find the right one. I have tried the following:

Hash:Salt
Salt:Hash
$NETNTLM$salt:hash
$NETNTLM$hashConfusedalt
$NETNTLM$salt$hash
$NETNTLM$hash$salt

I always get either a line-lenght exception error, a salt-length exception error or seperator unmatched. Can someone post a valid line that I can put in my hash file with the corresponding password so that I can check that everything is working (Not a "real" hash so that no one gets in trouble). Thanks.

EDIT: by salt I mean the challenge, of course.


RE: NetNTLMv1 format - Rolf - 05-16-2013

Howdy.
Check this out.


RE: NetNTLMv1 format - mastercracker - 05-16-2013

(05-16-2013, 07:02 AM)Rolf Wrote: Howdy.
Check this out.
Thanks. I was actually thinking that this page should be in the wiki but I did not check lately so I was not aware of it.


RE: NetNTLMv1 format - mastercracker - 05-16-2013

I still get the Salt-length exception error using the hash provided in the wiki's hash example. Here's what's in the test.hash file:
Code:
u4-netntlm:kNS::338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c
Here's the command line:
Code:
oclhashcat-plus32.exe -a 3 --force -o found.txt -m 5500 --remove -1 ?s?d?l test.hash ?a?1?1?1?1?1
What's wrong?


RE: NetNTLMv1 format - philsmd - 05-16-2013

This example works for me:
Code:
u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c

Seems that the wiki page has a small error (position of the double-colon). Anyone can fix that?

For other examples, please see here: https://hashcat.net/trac/ticket/98


RE: NetNTLMv1 format - atom - 05-16-2013

fixed, thanks


RE: NetNTLMv1 format - mastercracker - 05-17-2013

Yes. That did the trick. Thanks.