Convert ntlmv1 john to hashcat
#1
Hi everybody,

I have a ntlmv1 john the ripper format hash and I would like to run that with hashcat, but hashcat can't read the hash format.

The hash output is in the following format:
user@domain.com:$NETNTLM$b412549e207a01d2$6fb6eac4a195e3643b735c1b177d263dd2041b90478c7dc5

Now I have found the following article in the archives:
http://hashcat6.rssing.com/browser.php?i...9&item=214

But I don't really understand the following:

Code:
perl -ne '/(.*?):\$.*?\$(.*?)\$(.*)/; print "$1::::$3:$2\n";'

If somebody would be so kind to explain what this means I will be very greatfull.


Kind regards,
M-H
#2
is a regular expression. it basically is taking out what it needs and putting it into the format hashcat wants.
#3
Ok I see.
After a long search I found the following perl script:
https://github.com/caseydunham/jtr-to-hashcat

You just have to put the jtp hash format in a tekst file and give an output file
perl Convert.pl <inputfile> <outputfile>

Just wanted to mention this because there where a lot of questions how to convert this.


But after I run this the outputhash is smaller then the length of the hash that I found here:
https://hashcat.net/wiki/doku.php?id=example_hashes
The output file that I get is:
user@domain.com::::6fb6eac4a195e3643b735c1b177d263dd2041b​90478c7dc5:b412549e207a01d2
#4
I have tried this with hashcat and I can confirm that it works.

I just love hashcat Smile.
#5
love it when there are users capable solving their own problems Smile