I ran Responder in a test network and obtained hashes from a Windows machine. The logs for the machine show something like this (some bytes changed for security reasons) and are stored in a file called "SMB-NTLMv2-SSP-192.168.2.12.txt":
The options i used in Responder were -wF.
The problem is i cannot crack this hash at all. All guides show the attacker inputting the log file into hashcat or JohnTheRipper and the hash being cracked, but when I do it i get:
In John: "No password hashes loaded (see FAQ)" In Hashcat: "No hashes loaded"
It seems both programs are unable to recognize the hash. Also, i'm confused: what does each field (separated by a semicolon) mean in the hash? I know it's a challenge-response protocol, so which part is the challenge and which one is the response?
Thanks in advance!!