+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: NTLM list with Duplicate Hashes (/thread-6395.html)
NTLM list with Duplicate Hashes - N0ur5 - 03-16-2017
Hello,
I have cracked a list of NTLM hashes and noticed the following...
For example:
User1:123456789
User2:987654321
User3:123456789
It appears that when I run hashcat, user1 will show up on my output file but not user3 even though they have the same hash.
My command basically was this:
hashcat -a 0 -m 1000 -r rulefile.rule --potfile-path potfile.pot -o cracked.txt --username hashfile.out rockyou.txt
then
hashcat --show -m 1000 --outfile-format 2 --potfile-path potfile.pot -o cleancracked.txt --username hashfile.out
Is there a command that I am missing to crack duplicates instead of only cracking the first one in the list?
I will continue to research on my own but would love to hear any thoughts or advice.
Thank you!
N0ur5
RE: NTLM list with Duplicate Hashes - philsmd - 03-16-2017
Do you use the latest version of hashcat (3.40 currently)?
RE: NTLM list with Duplicate Hashes - N0ur5 - 03-16-2017
(03-16-2017, 04:08 PM)philsmd Wrote: Do you use the latest version of hashcat (3.40 currently)?
No actually it appears I have v3.30.
I will update and see what happens.
RE: NTLM list with Duplicate Hashes - N0ur5 - 03-16-2017
(03-16-2017, 04:14 PM)N0ur5 Wrote:(03-16-2017, 04:08 PM)philsmd Wrote: Do you use the latest version of hashcat (3.40 currently)?
No actually it appears I have v3.30.
I will update and see what happens.
Still no luck. It almost seems like once the potfile has a hash found in it, the first user that has that hash is the only one that ends up decrpyted in my output file, but if I go to my hash file I have 5 users with that hash. Only the first user on my hash file with that hash is the only user who ends up in the decrypted/cracked output. Strange
RE: NTLM list with Duplicate Hashes - N0ur5 - 03-16-2017
I got it, just had to tweak with flags.
Code that worked:
hashcat -m 1000 --show -o showoutput.txt hashfile.txt --username
Thanks!
N0ur5