problem with ntlm hash
#1
I am trying to break ntlm hashes. Hashcat doesn't seem to detect the hashes.
Here is my test ntlm hash file:

fffffff89c38368724b98c4016622476
fffffff439e17f169bbb2216d9c4e4e6

I am using  windows 10.

Here is the command line and the result of running it.

password-cracking\hashcat-6.2.6>hashcat.exe -m 1000 ntlm_sample.rawest ..\dictionaries\rock.dic
hashcat (v6.2.6) starting

* Device #1: WARNING! Kernel exec timeout is not disabled.
            This may cause "CL_OUT_OF_RESOURCES" or related errors.
            To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #2: WARNING! Kernel exec timeout is not disabled.
            This may cause "CL_OUT_OF_RESOURCES" or related errors.
            To disable the timeout, see: https://hashcat.net/q/timeoutpatch
CUDA API (CUDA 12.2)
====================
* Device #1: NVIDIA GeForce RTX 3060 Ti, 7142/8191 MB, 38MCU

OpenCL API (OpenCL 3.0 CUDA 12.2.79) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #2: NVIDIA GeForce RTX 3060 Ti, skipped

OpenCL API (OpenCL 2.0 AMD-APP (1912.5)) - Platform #2 [Advanced Micro Devices, Inc.]
=====================================================================================
* Device #3: , skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hash 'ntlm_sample.rawest': Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)

No hashes loaded.

Started: Sat Aug 17 11:17:11 2024
Stopped: Sat Aug 17 11:17:13 2024

Why can't hashcat detect the NTLM hashes?
Reply
#2
I assume you've already solved this but it's just because Hashcat can't find your file. Make sure the file name in your command matches the real name of the file and double check that it's in the same folder as Hashcat or use the absolute path of the hashfile
Reply
#3
That did it. Thanks.
Reply