Hashcat

Usage

If using hashcat.exe on Windows, open the hash file with Notepad++ and go to: Encoding → Convert to UTF-8 (without BOM).

hashcat -a 0 -m 18200 user_hash /usr/share/wordlists/rockyou

For the Domain Cached Credentials 2 (DCC2), the domain and username must be removed; only the value starting with $DCC2$ is required.

$ cat /home/plaintext/.cme/logs/MS01_10.129.204.133_2022-11-08_093944.cached| cut -d ":" -f 2
$DCC2$10240#julio#c2139497f24725b345aa1e23352481f3
$DCC2$10240#david#a8338587a1c6ee53624372572e39b93f
$DCC2$10240#john#fbdeac2c1d121818f75796cedd0caf0a

Rules

hashcat includes a variety of effective rules in /usr/share/hashcat/rules. Custom file rules can also be created.

  • If rule functions are on the same line, they are applied consecutively to each word.

  • If rule functions are on separate lines, each line is treated as a separate rule.

# initial password file
$ cat mutating_example.txt
password

# capitalize the first letter & add '1' at the end simultaneously
$ echo 'c $1' > rule1.txt && cat rule1.txt
c $1

$ hashcat -r rule1.txt --stdout mutating_example.txt
Password1

# capitalize the first letter, add '1' at the end
$ echo -e 'c\n$1' > rule2.txt && cat rule2.txt
c
$1

$ hashcat -r rule2.txt --stdout mutating_example.txt
Password
password1

Optimization

Enable a specific workload profile -> default is 2; use 3 if the PC focuses just on Hashcat.

Hash Types

Just passing the hash file ($ hashcat example_hash) will have the hash type autodetected.

Type
Mode

$krb5asrep$23$

18200

$krb5tgs$23$

13100

NTLMv2

5600

NTLM

1000

$krb5asrep$17$

32100

$krb5asrep$18$

32200

$krb5tgs$17$

19600

$krb5tgs$18$

19700

NTLMv2 (NT)

27100

$DCC2$10240

2100

MD5

500

KeePass (keepass2john)

13400

$sshng$6$ (ssh2john)

22921

Cracking Time

Cracking time is determined by dividing the keyspace by the hash rate:

  • Keyspace is calculated as the character set raised to the power of the password length. For example, with lowercase (26), uppercase (26), and digits (10), the character set totals 62. A five-character password would have 62^5 possible combinations.

  • The hash rate is a measure of how many hash calculations can be performed in a second (1 MH/s equals 1,000,000 hashes per second).

Increasing password length increases cracking duration by exponential time, while increasing password complexity (charset) only increases cracking duration by polynomial time.

Exponential time grows much faster than polynomial time.

  • Polynomial time (e.g., n2n^2n2, n3n^3n3): As input nnn increases, the number of steps grows at a manageable rate.

  • Exponential time (e.g., 2n2^n2n, 3n3^n3n): The number of steps doubles, triples, or grows even faster with each increase in nnn, making it impractical for large inputs.

Resources

LogoGitHub - hashcat/hashcat: World's fastest and most advanced password recovery utilityGitHub

PreviousHashIDNextJohn

Last updated

Was this helpful?