Hash Cracking

Identifying hash formats

hashid <hash>

John

hashid -j <hash>

Hashcat

hashid -m <hash>

LM

John

john --format=lm hash.txt

Hashcat

NT

John

john --format=nt hash.txt

Hashcat

NetNTLMv1

John

john --format=netntlm hash.txt

Hashcat

crack.sh

NetNTLMv2

John

john --format=netntlmv2 hash.txt

Hashcat

Kerberos 5 TGS

John

john spn.txt --format=krb5tgs --wordlist=wordlist.txt

Hashcat

Kerberos 5 TGS AES128

Hashcat

hashcat -m 19600 -a 0 spn.txt wordlist.txt

Kerberos 5 TGS AES256

Hashcat

hashcat -m 19700 -a 0 spn.txt wordlist.txt

Kerberos ASREP

Hashcat

hashcat -m 18200 -a 0 AS-REP_roast-hashes wordlist.txt
sudo hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

MsCache 2

Hashcat

hashcat -m 2100 -a 0 mscache-hash wordlist.txt

MD5

john

john hash --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5
john hash --show --format=Raw-MD5

Hashcat

Attack modes

Dictionary Attack

Dictionary attack (-a 0) is, as the name suggests, a dictionary attack. The user provides password hashes and a wordlist as input, and Hashcat tests each word in the list as a potential password until the correct one is found or the list is exhausted.

hashcat -a 0 -m 0 e3e3ec5831ad5e7288241960e5d4fdb8 /usr/share/wordlists/rockyou.txt

Dictionary Attack with rules

hashcat -a 0 -m 0 1b0556a75770563578569ae21392630c /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Mask Attack

Mask attack (-a 3) is a type of brute-force attack in which the keyspace is explicitly defined by the user. For example, if we know that a password is eight characters long, rather than attempting every possible combination, we might define a mask that tests combinations of six letters followed by two numbers.

Symbol	Charset
?l	abcdefghijklmnopqrstuvwxyz
?u	ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d	0123456789
?h	0123456789abcdef
?H	0123456789ABCDEF
?s	«space»!"#$%&'()*+,-./:;<=>?@[]^_`{
?a	?l?u?d?s
?b	0x00 - 0xff
Let's say that we specifically want to try passwords which start with an uppercase letter, continue with four lowercase letters, a digit, and then a symbol. The resulting hashcat mask would be ?u?l?l?l?l?d?s.

hashcat -a 3 -m 0 1e293d6912d074c0fd15844d803400dd '?u?l?l?l?l?d?s'