Question About NTLM

[markgamache]

Your unicode byte order is simply backwards.  it should be 680065006c00 and so on...

It's exactly as you said.

Code:

root@ht:~/hashcat# echo -n password | iconv -f utf8 -t utf16le | openssl dgst -md4
(stdin)= 8846f7eaee8fb117ad06bdd830b7586c

Ok, I was more wondering how does the password get converted to unicode before its hashed, like...

hello --unicode--> 00680065006c006c006f --MD4--> c086551358a173bab054b4d5d694737f

but that isn't right,

hello --NTLM--> 066ddfd4ef0e9cd7c256fe77191ef43c

so how could I convert it to just the unicode so I could hash it using MD4?