hashcat Forum

I've pulled ntds.dit and the system hive from a Win2008r2 domain controller and I'm trying to dump the hashes and crack them with hashcat.

The output from secretsdump is showing 33 character long lmhash and nthash. Why would this be? 

From what I've been reading I should be getting ms cache2 out of secretsdump. I've reformatted the output to look like -m 2100 with DCC2, 10240, username (with and without domain name), and nthash. Is that right?


Thank you everyone!!

Got it!! Bad libraries + corrupt ntds.dit! Re-built the box from scratch, fixed the corrupt ntds.dit, alllll gravy

(02-13-2017, 06:05 PM)gentoo9ball Wrote: [ -> ]I've pulled ntds.dit and the system hive from a Win2008r2 domain controller and I'm trying to dump the hashes and crack them with hashcat.

The output from secretsdump is showing 33 character long lmhash and nthash. Why would this be? 

From what I've been reading I should be getting ms cache2 out of secretsdump. I've reformatted the output to look like -m 2100 with DCC2, 10240, username (with and without domain name), and nthash. Is that right?


Thank you everyone!!