I have a number of LM hashes that I have been attempting to crack with hashcat. My understanding was that LM splits passwords into two separate 7 character strings before they are hashed. I also believe that they only use uppercase letters, as well as digits and special characters.
I have attempted to run the following command in hashcat:
hashcat64.exe -m 3000 -a 3 lm-out.txt -1 ?u?d?s --increment ?1?1?1?1?1?1?1
This should brute force every possible combination with the acceptable characters for LM from 1-7 characters long - however, after running this to completion, it has only recovered 0.20% of all passwords?
I was wondering if anyone could shed any light on this for me? I know that hashcat's special characters mask does not include the pound sign, but I can't understand why over 99% of the passwords would not be brute forced in this way? The fact that some were recovered as simple words leads me to believe that they can't be being altered in some way before being hashed.
(Also, I work in cyber security, so this is not a "Black Hat" request in any way!)
I tried the sample hashes from hashcat.net/wiki/doku.php?id=example_hashes , to rule out a problem with hashes getting corrupted, as Rory suggested, but it has managed to extract about 20 passwords from the hashes, which is what leads me to believe the hashes can't have been corrupted or that there isn't an additional layer of security somehow, as surely this would affect every hash, not just most of them?
All of the hashes were extracted at once from the NTDS.dit file by the same script, so they should either all be okay, or all be corrupt? Unless I've misunderstood that suggestion?
Relating to Royce's answer (Thanks for the comprehensive response):
When I say pound - I am actually English so I mean literally the "£" symbol rather than "#". When I checked the special characters charset on the hashcat wiki the "£" symbol did not appear in that list? As it is an English hash dump as well, I wondered if that might be part of the problem? Apologies for the confusion!
Regarding the hashes that have been cracked - they are all either 7 for the first part and blank for the second, or 7 for the first part and 1-6 for the second. They are alpha numeric with ! as the only special character. They are actual words, or words that have been mangled with numbers instead of letters.
I do not have access to the target system any more, but surely the fact that some of the hashes have been cracked would mean that the problem can't be in the approach? In the sense that the ones that worked were extracted in the same way?
I'm not sure I would know how to discover the system's default code page/character set, and as I do not have access to the system any more, I don't know I can answer that one. Would there be any difference between UK English and US English that might be causing problems if Hashcat is assuming US?
If ALT characters were used that forced the passwords to be stored as NTLM, would this not replace all the LM hashes for those passwords with one standard "Blank" hash? That is something that has been confusing me, as all of the uncracked hashes are different, meaning I have assumed they are hashes of differing values. I had also thought it unlikely that over 99% of the users would have been using crazy, non-standard characters in their passwords! (Especially given the passwords that have been cracked!)
To extract the hashes I made a volume shadow copy and grabbed NTDS.dit and SYSTEM. I then used esedbexport to extract the tables and ntdsxtract (specifically dsusers.py) to extract the hashes. I think this is a fairly standard route, but I can post links to the tools, or more exact information on my process there if you wanted it clarified.
Again though, I think the thing that keeps throwing me is that some of the hashes are cracking, so if there was an error in this process, or even with the system charset, would it not have made every single hash gibberish?
Thanks again for your help Royce, much appreciated.
(Also, advising against LM backwards compatibility is definitely something we have already done!)