hashcat Forum

Good morning!

I recently captured netntlmv1 hashes from an engagement I'm on and they are not being parsed by hashcat. I remember doing this in the past, so i'm not sure what happened.

I also tried using the example hashes on from the wiki and those too are not being parsed. Here's output from the wiki and a test hash i captured.

Code:
hashcat () starting...

OpenCL Platform #1: Apple

=========================

* Device #1: Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz, skipped

* Device #2: Iris Pro, 384/1536 MB allocatable, 40MCU

* Device #3: AMD Radeon R9 M370X Compute Engine, 512/2048 MB allocatable, 10MCU

Hashfile 'netntlmv1-test.txt' on line 1 (u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception

Hashfile 'netntlmv1-test.txt' on line 2 (bob::::236696db60af0ffddd599edc72768f484b67513440fe9145:7cf8afb4c3b35baec23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception

Parsing Hashes: 0/2 (0.00%)...No hashes loaded

Started: Tue Nov  1 08:17:15 2016

Stopped: Tue Nov  1 08:17:15 2016

I realize that my test hash is missing some of the data from the example hash on the wiki, but it does crack in JtR. I'd prefer to use hashcat as it will run much faster.

Hashcat 2.0 this did work:

Code:
./hashcat-cli64.app -m 5500 netntlmv1.txt -a 3 ?a?a?a

Initializing hashcat v2.00 with 8 threads and 32mb segment-size...

Added hashes from file netntlmv1.txt: 2 (2 salts)

BOB::::236696db60af0ffddd599edc72768f484b67513440fe9145:7cf8afb4c3b35bae:bob

[s]tatus [p]ause [r]esume [b]ypass [q]uit => 

Input.Mode: Mask (?a?a?a) [3]

Index.....: 0/1 (segment), 857375 (words), 0 (bytes)

Recovered.: 1/2 hashes, 1/2 salts

Speed/sec.: - plains, - words

Progress..: 857375/857375 (100.00%)

Running...: --:--:--:--

Estimated.: --:--:--:--

Started: Tue Nov  1 08:52:19 2016            

Stopped: Tue Nov  1 08:52:20 2016

(11-01-2016, 02:21 PM)fuzztester Wrote: [ -> ]Good morning!

I recently captured netntlmv1 hashes from an engagement I'm on and they are not being parsed by hashcat. I remember doing this in the past, so i'm not sure what happened.

I also tried using the example hashes on from the wiki and those too are not being parsed. Here's output from the wiki and a test hash i captured.

Code:
hashcat () starting... OpenCL Platform #1: Apple ========================= * Device #1: Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz, skipped * Device #2: Iris Pro, 384/1536 MB allocatable, 40MCU * Device #3: AMD Radeon R9 M370X Compute Engine, 512/2048 MB allocatable, 10MCU Hashfile 'netntlmv1-test.txt' on line 1 (u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception Hashfile 'netntlmv1-test.txt' on line 2 (bob::::236696db60af0ffddd599edc72768f484b67513440fe9145:7cf8afb4c3b35baec23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c ): Salt-length exception Parsing Hashes: 0/2 (0.00%)...No hashes loaded Started: Tue Nov 1 08:17:15 2016 Stopped: Tue Nov 1 08:17:15 2016

I realize that my test hash is missing some of the data from the example hash on the wiki, but it does crack in JtR. I'd prefer to use hashcat as it will run much faster.

There's a space at line end

fuzztester

fuzztester

atom