I'm currently testing standard pentest stuff on a Windows XP SP3 VM. I managed to compromise it and saved the SAM file with the password hashes. I used ophcrack with the "fast and free" and "small and free" rainbow tables, but I only got a lanmanager password, no NT password.

If I understood it right the LM password is correct, but insensitive to the original case. So what I want to do is to take the password and generate all possible permutations of cases. Example:

Lets say the gathered pw is ABCD0, then I want to generate


I haven't found any predefined rule, the only lanman hash related ones are for cracking the password - which I already did. I guess a custom rule must be written and checked, I guess the command TN ("toggle case of the character in position N") is the right one, but so far I managed only to toggle it one time and not in all permutations.

How do I do that?

1 Answer 1


Allright, I found the solution, it's already in the john.conf file, only not easily found. I'll answer myself so people who search for this question can find the answer as well.

The needed rules are labeled [List.Rules:NT] in john.conf, so to invoke those you simply need to specify --rules=NT as a parameter when calling john.

The rules relevant for this simply toggle the case of each character for each of up to 13 chars, since longer passwords don't get lanmanager hashes, and will only have NT hashes. It's done this way:

-c T0Q
-c T1QT[z0]
-c T2QT[z0]T[z1]
-c T3QT[z0]T[z1]T[z2]
-c T4QT[z0]T[z1]T[z2]T[z3]
-c T5QT[z0]T[z1]T[z2]T[z3]T[z4]
-c T6QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]
-c T7QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]
-c T8QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]
-c T9QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]
-c TAQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]
-c TBQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]
-c TCQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]
-c TDQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]T[zC]
  • In many cases it can be easier to generate a wordlist in a scripting language.
    – Arminius
    May 24, 2016 at 15:10
  • That may be right, but not in the specific case of having one or two lanmanager passwords instead of a wordlist I'd say - with this you really limit the amount of tries to those absolutely necessary. A wordlist will probably not contain passwords like Q4AB0CD while in my specific case the lanman password was in exactly this style.
    – Draugr
    May 24, 2016 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .