Skip to content

Problem identifying windows xp ntlm hashes #147

Description

@Kyu
cat cracking4.txt
21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823
11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C
65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285
FBBDA33FC12E83FB0C240E84A183686E:DDE9DC6E34E2E6E11EF9E51C6B27ED96
21C4E7C2EFE8E8D1C00B70065ED76AA7:A7A0F9AFD4A78F531A1CF4C42E531BBF
E85B4B634711A266AAD3B435B51404EE:FD134459FE4D3A6DB4034C4E52403F16
BA756FB317B622DBAAD3B435B51404EE:C8405270B10B13AE8A24612BB853567A
199C926FA387EAB7AAD3B435B51404EE:F196F77BF8BB15781BA8364C649C5FD4
FE4AACAAAD7D986AAAD3B435B51404EE:3928E16F614E2316CA51C336FA5B3011
3613F7EC15407F56AAD3B435B51404EE:C82E164316183AA3AF3EA6BAA642A237

nth -f cracking4.txt
# Truncated for readiblilty 
21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

However, these can be cracked using 1000 mode in hashcat (after truncating the first part of the string with delimiter as :)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions