+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Hashes from hostapd-wpe - MSCHAPv2 - Challenge and Response (/thread-7041.html)
Hashes from hostapd-wpe - MSCHAPv2 - Challenge and Response - enignmahacker - 11-23-2017
Hello everyone!
Could you please help me to crack MSchapv2 captured using hostapd-wpe ?
#Test hash#
mschapv2: Tue Nov 21 14:48:49 2017
username: marcelo
challenge: a1:xx:xx:b5:6a:xx:xx:cb
response: aa:32:4x:xx:x0:ce:25:d9:7x:xx:x1:d9:6a:f5:80:14:ex:xx:xf:01:6f:xx:xx:8f
jtr NETNTLM: marcelo:$NETNTLM$a1xxxxb56axxxxcb$aa324xxxx0ce25d97xxxx1d96af58014exxxxf016fxxxx8f mschapv2: Tue Nov 21 14:49:16 2017
Hi guys does anyone know how to crack mschapv2? I've tried using -m 5500, but my hash (string) is not compatible, it seems I'm missing a 3rd part of it. I basically have challenge and response.
The closest I got was to this threat https://hashcat.net/forum/archive/index.php?thread-2563.html, but still did not find how to convert my hash to hash cat format.
They say execute the command below, but where should I pass my string (challenge and response)?
perl -ne '/(.*?):\$.*?\$(.*?)\$(.*)/; print "$1::::$3:$2\n";'
Thanks everyone.
RE: Hashes from hostapd-wpe - MSCHAPv2 - Challenge and Response - evilmog - 11-23-2017
echo 'marcelo:$NETNTLM$a1xxxxb56axxxxcb$aa324xxxx0ce25d97xxxx1d96af58014exxxxf016fxxxx8f' | perl -ne '/(.*?):\$.*?\$(.*?)\$(.*)/; print "$1::::$3:$2\n";'
marcelo::::aa324xxxx0ce25d97xxxx1d96af58014exxxxf016fxxxx8f:a1xxxxb56axxxxcb
hashcat64.exe -m 5500 -a 0 marcelo::::aa324xxxx0ce25d97xxxx1d96af58014exxxxf016fxxxx8f:a1xxxxb56axxxxcb example.dict
RE: Hashes from hostapd-wpe - MSCHAPv2 - Challenge and Response - EnignmaH@ck3r - 11-23-2017
Thank you so much. Worked fine.
edit by philsmd:
stop posting hashes. It is against the forum rules. do not use 2 accounts to post
RE: Hashes from hostapd-wpe - MSCHAPv2 - Challenge and Response - evilmog - 11-24-2017
(11-23-2017, 02:24 AM)alexpache Wrote: Thank you so much. Worked fine.
edit by philsmd:
stop posting hashes. It is against the forum rules. do not use 2 accounts to post
Only reason I replied with those hashes is the plaintext was in example.dict and was aa[redacted]aa, came back in 30 seconds so I believe it was a test hash like what was in the example hashes