Yesterday, 03:27 PM
Hashcat does not handle unicode well.
I set an windows account password to € (using alt+0128 or by copy/paste from wikipedia article about Euro sign). This gets me the NTLM hash 030926b781938db4365d46adc7cfbcb8 on the windows system (extracted using mimikatz). Which is also what I get if I manually MD4 the hex characters AC 20.
I then used hashcat.exe --a 3 --increment -m 1000 030926b781938db4365d46adc7cfbcb8 "?b?b?b?b" to get
This is weird because that would suggest it is 3 bytes.
When I run hashcat.exe --show -m 1000 030926b781938db4365d46adc7cfbcb8 --outfile euro.txt --outfile-format=3 I get
Which is not ac20 as expected.
I set an windows account password to € (using alt+0128 or by copy/paste from wikipedia article about Euro sign). This gets me the NTLM hash 030926b781938db4365d46adc7cfbcb8 on the windows system (extracted using mimikatz). Which is also what I get if I manually MD4 the hex characters AC 20.
I then used hashcat.exe --a 3 --increment -m 1000 030926b781938db4365d46adc7cfbcb8 "?b?b?b?b" to get
Code:
030926b781938db4365d46adc7cfbcb8:€
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1000 (NTLM)
Hash.Target......: 030926b781938db4365d46adc7cfbcb8
Time.Started.....: Tue Dec 2 14:19:30 2025 (0 secs)
Time.Estimated...: Tue Dec 2 14:19:30 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?b?b?b [3]
Guess.Queue......: 3/4 (75.00%)This is weird because that would suggest it is 3 bytes.
When I run hashcat.exe --show -m 1000 030926b781938db4365d46adc7cfbcb8 --outfile euro.txt --outfile-format=3 I get
Code:
e282ac