Using Windows LSA Hashes obtained from crackmapexec

Question

I have obtained some hashes using crackmapexec and dumping from the LSA process. The hashes are in this form (data below is fake):

adm_name:c6f132a235209036744ba5d303bd5d9b:SOME.ORGANISATION.COM:ORGANISATION:::

The hash identifying utilities in Kali do not recognise the hash as is but do give some output if the hash is modified.
For tool hash-identifier input:

c6f132a235209036744ba5d303bd5d9b

Results:

Possible Hashs:
[+]  MD5
[+]  Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))

For tool hashid input:

adm_name:c6f132a235209036744ba5d303bd5d9b

Outputs:

[+] Domain Cached Credentials 
[+] Domain Cached Credentials 2

john accepts the hashes as is but reports:

Warning: detected hash type "LM", but the string is also recognized as "NT"
Use the "--format=NT" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "HAVAL-128-4"
Use the "--format=HAVAL-128-4" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "lotus5"
Use the "--format=lotus5" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "MD2"
Use the "--format=MD2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mdc2"
Use the "--format=mdc2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mscash"
Use the "--format=mscash" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mscash2"
Use the "--format=mscash2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD4"
Use the "--format=Raw-MD4" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD5"
Use the "--format=Raw-MD5" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD5u"
Use the "--format=Raw-MD5u" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "ripemd-128"
Use the "--format=ripemd-128" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Snefru-128"
Use the "--format=Snefru-128" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "NT-old"
Use the "--format=NT-old" option to force loading these as that type instead

hashcat will attempt to crack (using the -m 1000 flag for NTLM hash types) if the format is just the digest (as in the hash-identifier input example above.)

I take it they cannot be used in a "pass the hash" attack as the digest appears to be the cached NT Hash (unsalted MD4) credential type. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994565(v=ws.11)

Apart from revealing usernames, what use are these hashes in this form to an attacker? Any guidance would be great!

Answer 1

DCC are their own format. In JtR, they are:

mscash-opencl
mscash2-opencl

... and in hashcat, they are:

1100 | Domain Cached Credentials (DCC), MS Cache        | Operating Systems
2100 | Domain Cached Credentials 2 (DCC2), MS Cache 2   | Operating Systems

As you noted, while these can be cracked, they cannot be used in pass-the-hash. They are also not guaranteed to be current - so even if you crack them, they may represent a now-expired password that cannot be used for "live", online authentication.