+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: NetNTLMv1 Hashes not parsing (/thread-5998.html)
NetNTLMv1 Hashes not parsing - fuzztester - 11-01-2016
Good morning!
I recently captured netntlmv1 hashes from an engagement I'm on and they are not being parsed by hashcat. I remember doing this in the past, so i'm not sure what happened.
I also tried using the example hashes on from the wiki and those too are not being parsed. Here's output from the wiki and a test hash i captured.
Code:
hashcat () starting...
OpenCL Platform #1: Apple
=========================
* Device #1: Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz, skipped
* Device #2: Iris Pro, 384/1536 MB allocatable, 40MCU
* Device #3: AMD Radeon R9 M370X Compute Engine, 512/2048 MB allocatable, 10MCU
Hashfile 'netntlmv1-test.txt' on line 1 (u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception
Hashfile 'netntlmv1-test.txt' on line 2 (bob::::236696db60af0ffddd599edc72768f484b67513440fe9145:7cf8afb4c3b35baec23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception
Parsing Hashes: 0/2 (0.00%)...No hashes loaded
Started: Tue Nov 1 08:17:15 2016
Stopped: Tue Nov 1 08:17:15 2016I realize that my test hash is missing some of the data from the example hash on the wiki, but it does crack in JtR. I'd prefer to use hashcat as it will run much faster.
RE: NetNTLMv1 Hashes not parsing - fuzztester - 11-01-2016
Hashcat 2.0 this did work:
Code:
./hashcat-cli64.app -m 5500 netntlmv1.txt -a 3 ?a?a?a
Initializing hashcat v2.00 with 8 threads and 32mb segment-size...
Added hashes from file netntlmv1.txt: 2 (2 salts)
BOB::::236696db60af0ffddd599edc72768f484b67513440fe9145:7cf8afb4c3b35bae:bob
[s]tatus [p]ause [r]esume [b]ypass [q]uit =>
Input.Mode: Mask (?a?a?a) [3]
Index.....: 0/1 (segment), 857375 (words), 0 (bytes)
Recovered.: 1/2 hashes, 1/2 salts
Speed/sec.: - plains, - words
Progress..: 857375/857375 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--
Started: Tue Nov 1 08:52:19 2016
Stopped: Tue Nov 1 08:52:20 2016(11-01-2016, 02:21 PM)fuzztester Wrote: Good morning!
I recently captured netntlmv1 hashes from an engagement I'm on and they are not being parsed by hashcat. I remember doing this in the past, so i'm not sure what happened.
I also tried using the example hashes on from the wiki and those too are not being parsed. Here's output from the wiki and a test hash i captured.
Code:hashcat () starting...
OpenCL Platform #1: Apple
=========================
* Device #1: Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz, skipped
* Device #2: Iris Pro, 384/1536 MB allocatable, 40MCU
* Device #3: AMD Radeon R9 M370X Compute Engine, 512/2048 MB allocatable, 10MCU
Hashfile 'netntlmv1-test.txt' on line 1 (u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception
Hashfile 'netntlmv1-test.txt' on line 2 (bob::::236696db60af0ffddd599edc72768f484b67513440fe9145:7cf8afb4c3b35baec23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception
Parsing Hashes: 0/2 (0.00%)...No hashes loaded
Started: Tue Nov 1 08:17:15 2016
Stopped: Tue Nov 1 08:17:15 2016
I realize that my test hash is missing some of the data from the example hash on the wiki, but it does crack in JtR. I'd prefer to use hashcat as it will run much faster.
RE: NetNTLMv1 Hashes not parsing - atom - 11-03-2016
There's a space at line end