hashcat Forum

I extracted the following hash from a windows 2008 r2 server with iis7.5.

Administrator:500:aad3b435b51404eeaad3b435b51404ee:7df4f3446bbe71004b781c59d521f494:::

I can easily crack the latter part of the hash. The LM hash seems to correspond a default value (disabled).


When I connect a display to this device, I cannot login to the server with this password using Administrator username.

I seem to be missing something

Are you sure the account is not disabled?

I guess it's possible that depending on how you extracted the hash, you are trying to login onto the domain with the local admin password or vice versa.