How to extract a hash (VNC, SSH2 or SMB) from a WireShark capture file

[halfie]

I think your VNC session was using encryption (at least at some point). I can successfully extract the "hash" from your .pcap file and also crack it using JtR-jumbo.

Please use latest versions of JtR-jumbo and Ettercap (from GitHub) for best results

Code:

$ ettercap -Tq -r Chomsky-ThreepWood-VNC-NoEncryption.cap ettercap 0.7.5.4 copyright 2001-2013 Ettercap Development Team ... 192.168.11.110-5901:$vnc$*a5d62a6cd58f41abe8785a4485811aac*248d3290ce533f028613f092f25834cf ... $ cat hash # copy-pasted from above outut 192.168.11.110-5901:$vnc$*a5d62a6cd58f41abe8785a4485811aac*248d3290ce533f028613f092f25834cf $ ../run/john hash Loaded 1 password hash (VNC DES [32/64]) 12345678 (192.168.11.110-5901)

As you can see, things do work