1

I ran Responder in a test network and obtained hashes from a Windows machine. The logs for the machine show something like this (some bytes changed for security reasons) and are stored in a file called "SMB-NTLMv2-SSP-192.168.2.12.txt":

user::user-PC:1122334455667788:0340FB9C9E4F88BEEBBC92105213BD05:0101000000000000D5F72CCE1F6AD301265492A58DFAC6E50000000002000A005300411111111111111101000A0053004D0042003100320004000A002364171BCD43100320003000A0053004D0042003100320005000A0053004D004200310032000800300030000000000000000100000000200000AAD247A0EB2290A13305EA760905EEFD95C50BF057C3BAEEABC821111111111111111100000000000000000000000000000000000900160063006900660073002F006100730064006100730066000000000000000000

The options i used in Responder were -wF.

The problem is i cannot crack this hash at all. All guides show the attacker inputting the log file into hashcat or JohnTheRipper and the hash being cracked, but when I do it i get:

In John: "No password hashes loaded (see FAQ)" In Hashcat: "No hashes loaded"

It seems both programs are unable to recognize the hash. Also, i'm confused: what does each field (separated by a semicolon) mean in the hash? I know it's a challenge-response protocol, so which part is the challenge and which one is the response?

Thanks in advance!!

Improve this question

1 Answer 1

Reset to default
3

Your Responder hash may be invalid, corrupt, or using an outdated format. Is it possible that you're using an older version of Responder, as noted in this question?

Showing my work:

Generally, the best way to validate your hashcat attack is correct for a specific hash type is to try your attack against an example hash from the hashcat wiki list of example hashes. For NetNTLMv2 (mode 5600 - is that what you're using?), here is the example hash for the string 'hashcat':

admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030

... which my hashcat (4.0.1) loads fine for me with:

hashcat -m 5600 -a 3 test.hashes

But my version of hashcat fails to load your hash -- not with the "no hashes loaded" that you're seeing, but with a "salt-value exception" error. (Is it possible that you're running an older version of hashcat?)

I also tried a couple of the Responder hashes shown in some tutorial articles (like this one), and I am able to load those into hashcat using -m 5600.

So I've tentatively concluded that there's something wrong with your hash.

Improve this answer
2
  • 1
    Hey! I could get it to work. John doesn't support NTLM, i think, but Hashcat was only missing the "-m 5600" option. I think the "salt-value exception" you got is because i changed a few bytes of the hash in the question for security reasons. Thanks for the help!
    – Lucas Cioffi
    Dec 1, 2017 at 19:44
  • 1
    Ah,I see - totally makes sense. Yes, if you don't supply a target algorithm with -m ("mode"), hashcat defaults to -m 0 (MD5). :)
    – Royce Williams
    Dec 1, 2017 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.