Password Cracking - Hashcat

October 8, 2023

NetNTLMv2 - Crackstation

./hashcat.exe -a 0 -m 5600 $hashes .\wordlists\crackstation.txt.gz -o cracked -O -w 3 --hwmon-disable -r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

Rules - One Rule

-r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

Debug - Disable hardware monitoring

--hwmon-disable

NTLM - 1000 - NTLM options

./hashcat.exe -a 0 -m 1000 --force -O -w 4 --opencl-device-types 1,2

NTLM - 1000 - Auditing NTLMfrom a DC dump, first pass for low-hanging fruit passwords

.\hashcat.exe -a 0 -m 1000 .\clean-ntds.txt .\wordlists\rockyou.txt -o rockyou.txt -O -w 4 --force --opencl-device-types 1,2 -r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

NTLMv1 - 5500 - NTLM options

./hashcat.exe -a 0 -m 5500 --force -O -w 4 --opencl-device-types 1,2

NTLMv2 - 5600 - Auditing NTLMfrom a DC dump, first pass for low-hanging fruit passwords

.\hashcat.exe -a 0 -m 5600 .\clean-ntds.txt .\wordlists\rockyou.txt -o rockyou.txt -O -w 4 --force --opencl-device-types 1,2 -r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

NetNTLMv2 - 5600 - RockYou OneRule

./hashcat.exe -a 0 -m 5600 .\vulnnet.txt .\wordlists\rockyou.txt -O -w 3 --hwmon-disable -r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

NetNTLMv2 - 5600 - Crackstation/Onerule

./hashcat.exe -a 0 -m 5600 $hashes .\crackstation.txt.gz -o cracked -O -w 3 --hwmon-disable -r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

NetNTLMv2 - 5600 - trying hashes with Rockyou/ OneRule

.\hashcat.exe newhashes.txt rockyou.txt -r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

.\hashcat.exe $hashes $wordlist -r .\OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule

.\hashcat.exe -a 0 -m 5600 $hashes .\wordlists\Seclists\Passwords\Leaked-Databases\rockyou.txt.tar.gz -o cracked.txt -O -w 3 --hwmon-disable -r .\rules\leetspeak.rule --debug-mode=1 --debug-file=matched.rule

Kerberos 5, etype 23, TGS-REP - 13100 - Best64.rule with Rocktastic, Rockyou2021, Crackstation

.\hashcat.exe -m 13100 -a 0 .\hash.txt ..\Rocktastic12a.rar -o cracked.txt -O -w 3 --hwmon-disable -r ..\password-cracking-rules\best64.rule --debug-mode=1 --debug-file=matched.rule

.\hashcat.exe -m 13100 -a 0 .\hash.txt '..\rockyou2021.txt dictionary from kys234 on RaidForums\rockyou2021.txt.7z.001' -o cracked.txt -O -w 3 --hwmon-disable -r ..\password-cracking-rules\best64.rule --debug-mode=1 --debug-file=matched.rule

.\hashcat.exe -m 13100 -a 0 .\hash.txt ..\crackstation.txt.gz -o cracked.txt -O -w 3 --hwmon-disable -r ..\password-cracking-rules\best64.rule --debug-mode=1 --debug-file=matched.rule

Kerberos 5, etype 23, TGS-REP - 13100 - OneRuleToRuleThemStill.rule, Rocktastic, Rockyou2021, Crackstation

 .\hashcat.exe -m 13100 -a 0 .\hash.txt ..\crackstation.txt.gz -o cracked.txt -O -w 3 --hwmon-disable -r ..\OneRuleStill.rule --debug-mode=1 --debug-file=matched.rule

Kerberos 5, etype 23, TGS-REP - 13100 - BruteForce with Incremental mask 10 char

hashcat -m 13100 .\hash.txt -a 3 ?a?a?a?a?a?a?a?a?a?a --increment

troubleshooting

On Windows 10, if you get the error: CL_OUT_OF_RESOURCES: - Create file called wddm_timeout_patch.reg and put this inisde:


Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers]
"TdrLevel"=dword:00000000