41 lines
1.8 KiB
Markdown
41 lines
1.8 KiB
Markdown
- Hash types
|
|
- 1000 - NTLM
|
|
- 2100 - Domain Cached Credentials 2, MS Cache 2 (Iterations: 10240)
|
|
- `$DCC2$<iterations>#<username>#<hash>`
|
|
- 13100 - kerberoasted hash
|
|
- 18200 - ASREProasted hash
|
|
- a 0 - Wordlist
|
|
- `hashcat.exe -a 0 -m 1000 C:\Temp\ntlm.txt D:\Tools\rockyou.txt`
|
|
- Rules
|
|
- `hashcat.exe -a 0 -m 1000 C:\Temp\ntlm.txt D:\Tools\rockyou.txt -r rules\add-year.rule`
|
|
- Example custom rule to add "2020" to end of each:
|
|
- `$2$0$2$0`
|
|
- Hashcat Rules Docs:
|
|
- https://hashcat.net/wiki/doku.php?id=rule_based_attack
|
|
- a 3 - Mask
|
|
- `hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt ?u?l?l?l?l?l?l?l?d`
|
|
- `hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt -1 ?d?s ?u?l?l?l?l?l?l?l?1`
|
|
- Example masks
|
|
- `ZeroPointSecurity?d?d?d?d`
|
|
- a 1 - Combinator
|
|
- `hashcat.exe -a 1 -m 1000 C:\\Temp\\ntlm.txt D:\\Tools\\list1.txt D:\\Tools\\list2.txt -j $- -k $!`
|
|
- -j and -k add rule to left or right side of word, respectively
|
|
- a 6 - Hybrid Wordlist + Mask
|
|
- `hashcat.exe -a 6 -m 1000 C:\\Temp\\ntlm.txt D:\\Tools\\list.txt ?d?d?d?d`
|
|
- a 7 - Hybrid Mask + Wordlist
|
|
- `hashcat.exe -a 7 -m 1000 C:\\Temp\\ntlm.txt ?d?d?d?d D:\\Tools\\list.txt`
|
|
- Converting Pwnagotchi or other packet capture into hashcat crack-able format
|
|
- Installing
|
|
- `sudo apt install hcxtools -y`
|
|
- Converting
|
|
- `hcxpcaptool capture.pcap -z output.pmkid`
|
|
- `hcxpcaptool capture.pcap -o crackable.hccapx`
|
|
- Cracking
|
|
- `hashcat -m 2500 crackable.hccapx /usr/share/wordlists/rockyou.txt`
|
|
- `hashcat -m 16800 output.pmkid /usr/share/wordlists/rockyou.txt`
|
|
- Different ways put a single hash on one line.
|
|
- `cat pre_hash.txt | tr -d '[:space:]' > hash`
|
|
- `tr -d '[:space:]' < pre_hash.txt > hash`
|
|
- `cat bork.txt | tr -d "\r\n" > hash.txt`
|
|
- `cat pre_hash.txt | tr -d "\n" | tr -d " " > crackable_hash.txt`
|
|
- `perl -pe 's/^\s+|\s*$//g' pre_hash > hash` |