Custom charsets for Cyrillic passwords in NTLM hashes

[boreas]

Hi,

If I understand correctly, to provide a valid charset for the NTLM hashes we need to convert it to little endian.

In the example from https://hashcat.net/forum/thread-6384-po...l#pid34048:

Code:

$ hashcat -m900 -a3 --hex-charset -1 04354045 c2767da21725edccced3fd251e4d8619 ?1?1?1?1?1?1

how would you calculate '04354045'?

I've tried:

Code:

$ echo -n хер | iconv -f utf8 -t utf16le | xxd -e -p
450435044004

This works too, but such a generated charset is 2 bytes longer (6 vs. 4).