When you have LM and NTLM hashes, you can first crack the LM hashes and then use the recovered passwords to crack the NTLM hashes.
File hashcat-mask-lm.pot contains the passwords we recovered from brute-forcing the LM hashes.
This command creates file lm-results.txt:
hashcat-3.00\hashcat64.exe -m 3000 --username --show --potfile-path hashcat-mask-lm.pot --outfile-format 2 --outfile lm-results.txt lm.ocl.out
Content of lm-results.txt:
Administrator:ROOT1$ user01:123456 user03:RACHELLEANNE user04:ZORDIC7 user05:KURT!!! user06:GIRLISH2020 user07:AMOROSAOVEJA user08:453758487L user09:THURLOW1 user10:BEAUFORT1 user12:MAISIE2007 user14:YELIZ6 user15:TADOB user16:LM1181992 user17:CUNINGO user19:LZAC08@ user20:FEPARAGON user21:V user22:AS user23:Y6G user24:*QFT user25:*VQC( user26:976B0 user27:XJW*WL user28:A9LT5J$R user29:CRX3#W+F user30:F-62RQTO@M user31:8N)IMRGQ57_ user32:43PDLBR8TS#V user33:B#F1HVU@QZ7NK user34:WBJ_PVTZ6I42AV
The passwords are uppercase since they are recovered from LM hashes.
Now let’s extract the passwords:
gawk.exe -F : "{print $2}" < lm-results.txt > lm-passwords.txt
Result:
ROOT1$ 123456 RACHELLEANNE ZORDIC7 KURT!!! GIRLISH2020 AMOROSAOVEJA 453758487L THURLOW1 BEAUFORT1 MAISIE2007 YELIZ6 TADOB LM1181992 CUNINGO LZAC08@ FEPARAGON V AS Y6G *QFT *VQC( 976B0 XJW*WL A9LT5J$R CRX3#W+F F-62RQTO@M 8N)IMRGQ57_ 43PDLBR8TS#V B#F1HVU@QZ7NK WBJ_PVTZ6I42AV
And now we can use this list of passwords for a dictionary attack on the NTLM hashes. But passwords recovered from NTLM hashes can contain lowercase and uppercase letters. So we need to generate all possible combinations of lowercase and uppercase letters for our password list. This can be done with the toggle rule file toggles-lm-ntlm.rule I created with this new tool.
hashcat-3.00\hashcat64.exe -a 0 -m 1000 --potfile-path hashcat-lm-passwords-nt.pot --username --rules toggles-lm-ntlm.rule nt.ocl.out lm-passwords.txt
Output:
hashcat (v3.00-1-g67a8d97) starting... OpenCL Platform #1: Intel(R) Corporation ======================================== - Device #1: Intel(R) HD Graphics 5000, 356/1425 MB allocatable, 40MCU - Device #2: Intel(R) Core(TM) i7-4650U CPU @ 1.70GHz, skipped Hashes: 43 hashes; 43 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 16384 Applicable Optimizers: * Zero-Byte * Precompute-Init * Precompute-Merkle-Demgard * Meet-In-The-Middle * Early-Skip * Not-Salted * Not-Iterated * Single-Salt * Raw-Hash Watchdog: Temperature abort trigger disabled Watchdog: Temperature retain trigger disabled Cache-hit dictionary stats lm-passwords.txt: 274 bytes, 31 words, 507904 keyspace ATTENTION! The wordlist or mask you are using is too small. Therefore, hashcat is unable to utilize the full parallelization power of your device(s). The cracking speed will drop. Workaround: https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_to_create_more_work_for_full_speed INFO: approaching final keyspace, workload adjusted 32ed87bdb5fdc5e9cba88547376818d4:123456 9180c11efd4cb6149557f59b0cf80573:FEPARAGON adc5df4b1f4a1b2501bbeef236f5be92:V b6c0168748dcdba30141914c959d9f8c:Y6G 2a3d0e353eadfb8c7b5d7d503efad47d:aS e14af367857363b0f16418bcce9f96b9:*qFT a474953d36f287fefc73f8917ca27290:8N)IMRgQ57_ 024b7f87b902332ac1369f2fd1a1d4e9:976b0 458d16d08f6ba7c5c61cd3850b704015:A9LT5J$r 81ed9d39c208fb710f16fd01df2c5ea3:453758487l f85bbc519f1d4b9453d0d316d2f43efd:lm1181992 23f8c70f8c51c5535e4ef372ffe9500a:XjW*wL c57128805cc3e445a338126080ce52bb:*Vqc( 80fadb7eb493333387c36c3a30a86a9c:43PDlBR8tS#V c09c4e921a0f7763e22aa5f38d73016a:Lzac08@ eb37f9cd74303274cb923442a7348ef4:Root1$ 85ec40bb1fadfcd4f1cdd8f5c745338a:Crx3#W+f 584c3288cdb9249191d01028fc3c1d06:F-62RqTo@m 336413710df33e5d6ef4ba82ba762543:kurt!!! 2fce06c6e6303f0850416dfe57f809ac:WBJ_Pvtz6i42AV 7f5ab070d31e61251ab4ef78b6601941:yeliz6 0794f987708fd36dc158c3435d1e9d65:tadob 3081116936973f2a1019178a085e77cd:maisie2007 2a54f9c00701830e44923a19eea7df62:zordic7 236ff73b5ec46c68c37d27d51bd4fa8f:b#f1HvU@Qz7nk 0d870c8d2ed66211a6cd19b6c8c6939a:thurlow1 5bd6fddd235507a2baf82843b6174b4e:cuningo 8810b6cff094d7bbfa9254a47e460e8c:girlish2020 c1d5ff9561074a64e8164745f7e057a3:beaufort1 9aeae4ad385c29a8d3e25a2032df95ec:rachelleanne d10107259670c218d8389bb05a6ca9a5:amorosaoveja Session.Name...: hashcat Status.........: Exhausted Rules.Type.....: File (toggles-lm-ntlm.rule) Input.Mode.....: File (lm-passwords.txt) Hash.Target....: File (nt.ocl.out) Hash.Type......: NTLM Time.Started...: Fri Jul 15 23:02:55 2016 (1 sec) Speed.Dev.#1...: 468.3 kH/s (0.24ms) Recovered......: 31/43 (72.09%) Digests, 0/1 (0.00%) Salts Progress.......: 507904/507904 (100.00%) Rejected.......: 0/507904 (0.00%) Started: Fri Jul 15 23:02:55 2016 Stopped: Fri Jul 15 23:02:59 2016
And finally, we can display the result:
hashcat-3.00\hashcat64.exe -m 1000 --potfile-path hashcat-lm-passwords-nt.pot --username --show nt.ocl.out
Output:
hashcat (v3.00-1-g67a8d97) starting... Administrator:eb37f9cd74303274cb923442a7348ef4:Root1$ user01:32ed87bdb5fdc5e9cba88547376818d4:123456 user03:9aeae4ad385c29a8d3e25a2032df95ec:rachelleanne user04:2a54f9c00701830e44923a19eea7df62:zordic7 user05:336413710df33e5d6ef4ba82ba762543:kurt!!! user06:8810b6cff094d7bbfa9254a47e460e8c:girlish2020 user07:d10107259670c218d8389bb05a6ca9a5:amorosaoveja user08:81ed9d39c208fb710f16fd01df2c5ea3:453758487l user09:0d870c8d2ed66211a6cd19b6c8c6939a:thurlow1 user10:c1d5ff9561074a64e8164745f7e057a3:beaufort1 user12:3081116936973f2a1019178a085e77cd:maisie2007 user14:7f5ab070d31e61251ab4ef78b6601941:yeliz6 user15:0794f987708fd36dc158c3435d1e9d65:tadob user16:f85bbc519f1d4b9453d0d316d2f43efd:lm1181992 user17:5bd6fddd235507a2baf82843b6174b4e:cuningo user19:c09c4e921a0f7763e22aa5f38d73016a:Lzac08@ user20:9180c11efd4cb6149557f59b0cf80573:FEPARAGON user21:adc5df4b1f4a1b2501bbeef236f5be92:V user22:2a3d0e353eadfb8c7b5d7d503efad47d:aS user23:b6c0168748dcdba30141914c959d9f8c:Y6G user24:e14af367857363b0f16418bcce9f96b9:*qFT user25:c57128805cc3e445a338126080ce52bb:*Vqc( user26:024b7f87b902332ac1369f2fd1a1d4e9:976b0 user27:23f8c70f8c51c5535e4ef372ffe9500a:XjW*wL user28:458d16d08f6ba7c5c61cd3850b704015:A9LT5J$r user29:85ec40bb1fadfcd4f1cdd8f5c745338a:Crx3#W+f user30:584c3288cdb9249191d01028fc3c1d06:F-62RqTo@m user31:a474953d36f287fefc73f8917ca27290:8N)IMRgQ57_ user32:80fadb7eb493333387c36c3a30a86a9c:43PDlBR8tS#V user33:236ff73b5ec46c68c37d27d51bd4fa8f:b#f1HvU@Qz7nk user34:2fce06c6e6303f0850416dfe57f809ac:WBJ_Pvtz6i42AV
As you can see, we recovered all passwords shorter than 15 characters.
Didier Stevens 