How to extract a hash (VNC, SSH2 or SMB) from a WireShark capture file

[halfie]

I think your VNC session was using encryption (at least at some point). I can successfully extract the "hash" from your .pcap file and also crack it using JtR-jumbo.

Please use latest versions of JtR-jumbo and Ettercap (from GitHub) for best results

Code:

$ ettercap -Tq -r Chomsky-ThreepWood-VNC-NoEncryption.cap

ettercap 0.7.5.4 copyright 2001-2013 Ettercap Development Team
...
192.168.11.110-5901:$vnc$*a5d62a6cd58f41abe8785a4485811aac*248d3290ce533f028613f092f25834cf
...

$ cat hash # copy-pasted from above outut
192.168.11.110-5901:$vnc$*a5d62a6cd58f41abe8785a4485811aac*248d3290ce533f028613f092f25834cf

$ ../run/john hash
Loaded 1 password hash (VNC DES [32/64])
12345678         (192.168.11.110-5901)

As you can see, things do work