German Umlaute öäüß Hashcat under Windows ok, under Linux not

[Alpensepp]

Hi there!

I have a problem cracking a ntlm hash while using hashcat under Linux. For test purposes i created a ntlm hash and a md5 hash for the password "über". For the MD5 hash was "MD5SUM" used, for the ntlm hash i used a real PC with Windows 10 installed.

I checked the ntlm hash with Passware. It correctly gets "über" as plaintext Password


Under Linux (Ubuntu 22.04.1) i can crack the MD5 hash with

"./hashcat.bin [MD5-hash] -a3 -m0 über"

but the ntlm-hash won´t be found

"./hascat.bin [ntlm-hash] -a3 -m1000 über"

Using a WindowsPC with the same hashcat-version (latest ofc)

"./hascat.bin [ntlm-hash] -a3 -m1000 über"

brings the "über" into the potfile

I dont know how i could solve this riddle. Can anyone give me a hint or a direction for possible solutions?

Thx in advance

[b8vr]

Are you on an english language version of linux? I think the issue comes down to how the character sets are interpreted. If you create a file on Linux containing über, and make sure it's in utf8, then an -a0 attack with that list should work.

[Alpensepp]

i also thought that there was a problem with charsets.

The "locale" command shows, that everything is on DE_de.

I used iconv to assure that the wordlist.txt (containing "über") is utf8.

i checked that with "file -i wordlist.txt" again and made a
"cat wordlist.txt" and the result actually was "über".

in addition in using the wordlist.txt i also prompted "über" right into the commandline (in another try of course).

While running hashcat it shows candidates it uses to "crack" the hash - it shows "über --> über" so the client itself already shows that it really uses an "ü" correctly... i have really no idea