12-23-2013, 08:16 PM
BTW, anyone know why the double colon after the user name?
test::LAB:112...
Was there originally some other field meant to go there that is now omitted, or just some quirk of the format decision they made?
It almost seems like that's where the password should go if it was known, but even if that was the original intent I can't really say I like the idea of hashcat changing its output format just for this one hash style.
If that was the original intent, you can use:
awk -v OFS=":" -F "\t" '{print($1,$3,$2,$5,$4,$6)}' NTLMv2.LST
to accomplish this; hashcat just ignores that field and will try to crack it all the same. Could be useful for sanity/regression testing I suppose.
Anyway, doesn't really matter, just curious.
test::LAB:112...
Was there originally some other field meant to go there that is now omitted, or just some quirk of the format decision they made?
It almost seems like that's where the password should go if it was known, but even if that was the original intent I can't really say I like the idea of hashcat changing its output format just for this one hash style.
If that was the original intent, you can use:
awk -v OFS=":" -F "\t" '{print($1,$3,$2,$5,$4,$6)}' NTLMv2.LST
to accomplish this; hashcat just ignores that field and will try to crack it all the same. Could be useful for sanity/regression testing I suppose.
Anyway, doesn't really matter, just curious.