hi i am not sure if i am understanding an issue i am facing. I am thinking what you are talking about here relates to it.
i am trying to reverse an NTLMv1 to NTLM, using the --lm flag with responder.
but the hash i get after completing the downgrade does not give me any of the expected parameters, the format of the hash itself is different to what crack.sh's examples show.
what the examples show:
username::hostname:response:response:challenge
what my hash looks like:
username::hostname:challenge:response:response
the second response i get is 2.5 times larger than the first response, i.e:
user::host::1122334455667788:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
hashcat also identifies it as an ntlmv2 hash when in autodetect mode, strangely - if i dont downgrade and get the NTLMv2 hash, these are both vastly different with the NTLMv2 looking like an NTLMv2 should (alot longer). So im not sure if there has been some patching applied where it spits out some garbage instead, or if this is a different type of NTLMv1 hash variation? None of the ntlm reversing tools are successful, even if i rearrange the challenge to be at the end instead of the start.
Any help in understanding where i am at? and why the hash structure is different/whether anything can be done about it, would be greatly appreciated
thankyou
i am trying to reverse an NTLMv1 to NTLM, using the --lm flag with responder.
but the hash i get after completing the downgrade does not give me any of the expected parameters, the format of the hash itself is different to what crack.sh's examples show.
what the examples show:
username::hostname:response:response:challenge
what my hash looks like:
username::hostname:challenge:response:response
the second response i get is 2.5 times larger than the first response, i.e:
user::host::1122334455667788:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
hashcat also identifies it as an ntlmv2 hash when in autodetect mode, strangely - if i dont downgrade and get the NTLMv2 hash, these are both vastly different with the NTLMv2 looking like an NTLMv2 should (alot longer). So im not sure if there has been some patching applied where it spits out some garbage instead, or if this is a different type of NTLMv1 hash variation? None of the ntlm reversing tools are successful, even if i rearrange the challenge to be at the end instead of the start.
Any help in understanding where i am at? and why the hash structure is different/whether anything can be done about it, would be greatly appreciated
thankyou