1

I have obtained some hashes using crackmapexec and dumping from the LSA process. The hashes are in this form (data below is fake):

adm_name:c6f132a235209036744ba5d303bd5d9b:SOME.ORGANISATION.COM:ORGANISATION:::

The hash identifying utilities in Kali do not recognise the hash as is but do give some output if the hash is modified.
For tool hash-identifier input:

c6f132a235209036744ba5d303bd5d9b

Results:

Possible Hashs:
[+]  MD5
[+]  Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))

For tool hashid input:

adm_name:c6f132a235209036744ba5d303bd5d9b

Outputs:

[+] Domain Cached Credentials 
[+] Domain Cached Credentials 2

john accepts the hashes as is but reports:

Warning: detected hash type "LM", but the string is also recognized as "NT"
Use the "--format=NT" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "HAVAL-128-4"
Use the "--format=HAVAL-128-4" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "lotus5"
Use the "--format=lotus5" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "MD2"
Use the "--format=MD2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mdc2"
Use the "--format=mdc2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mscash"
Use the "--format=mscash" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mscash2"
Use the "--format=mscash2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD4"
Use the "--format=Raw-MD4" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD5"
Use the "--format=Raw-MD5" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD5u"
Use the "--format=Raw-MD5u" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "ripemd-128"
Use the "--format=ripemd-128" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Snefru-128"
Use the "--format=Snefru-128" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "NT-old"
Use the "--format=NT-old" option to force loading these as that type instead

hashcat will attempt to crack (using the -m 1000 flag for NTLM hash types) if the format is just the digest (as in the hash-identifier input example above.)

I take it they cannot be used in a "pass the hash" attack as the digest appears to be the cached NT Hash (unsalted MD4) credential type. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994565(v=ws.11)

Apart from revealing usernames, what use are these hashes in this form to an attacker? Any guidance would be great!

  • Are you asking how to identify them, or what use they are to an attacker? – forest May 10 '18 at 1:50
  • 1
    Edited the question to be clarify looking at how to use, added some info – user1330734 May 10 '18 at 2:28
2

DCC are their own format. In JtR, they are:

mscash-opencl
mscash2-opencl

... and in hashcat, they are:

1100 | Domain Cached Credentials (DCC), MS Cache        | Operating Systems
2100 | Domain Cached Credentials 2 (DCC2), MS Cache 2   | Operating Systems

As you noted, while these can be cracked, they cannot be used in pass-the-hash. They are also not guaranteed to be current - so even if you crack them, they may represent a now-expired password that cannot be used for "live", online authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.