Convert ntlmv1 john to hashcat

[magere-hein]

Hi everybody,

I have a ntlmv1 john the ripper format hash and I would like to run that with hashcat, but hashcat can't read the hash format.

The hash output is in the following format:
user@domain.com:$NETNTLM$b412549e207a01d2$6fb6eac4a195e3643b735c1b177d263dd2041b90478c7dc5

Now I have found the following article in the archives:
http://hashcat6.rssing.com/browser.php?i...9&item=214

But I don't really understand the following:

Code:

perl -ne '/(.*?):\$.*?\$(.*?)\$(.*)/; print "$1::::$3:$2\n";'

If somebody would be so kind to explain what this means I will be very greatfull.


Kind regards,
M-H

[coolbry95]

is a regular expression. it basically is taking out what it needs and putting it into the format hashcat wants.

[magere-hein]

Ok I see.
After a long search I found the following perl script:
https://github.com/caseydunham/jtr-to-hashcat

You just have to put the jtp hash format in a tekst file and give an output file
perl Convert.pl <inputfile> <outputfile>

Just wanted to mention this because there where a lot of questions how to convert this.


But after I run this the outputhash is smaller then the length of the hash that I found here:
https://hashcat.net/wiki/doku.php?id=example_hashes
The output file that I get is:
user@domain.com::::6fb6eac4a195e3643b735c1b177d263dd2041b​90478c7dc5:b412549e207a01d2

[magere-hein]

I have tried this with hashcat and I can confirm that it works.

I just love hashcat .

[atom]

love it when there are users capable solving their own problems