0

I've been given a non-salted NTLM hash and a week worth of time to find the password it hides. I have also been told the password length is 11 chars, and that it is a Windows 10 user password.

I'm wondering what the most efficient way of trying to recover the password would be? I've tried the sites online that attempt to crack them, and none of them work. However, onlinehashcrack reported they recovered the password (and confirmed the plaintext is 11 chars) but I must pay to unlock it. Either way, this isn't preferable as I will likely need the experience in the future. I've tried both dictionary and brute-force methods in Cain, but it says it will take a very long time on my current setup, and since I only have a week this isn't feasible.

Any help would be greatly appreciated. I haven't really worked with hashes or the like so sorry if this is obvious.

Improve this question
5
  • 1
    have you configured your tools to only try 11 character passwords and not "up to" 11 character passwords? – schroeder♦ Aug 25 '18 at 20:03
  • I believe so. I don't see the options for dictionary attacks. – Brandon G Aug 25 '18 at 21:14
  • Nice. Looks like you will have your answer in about 27 million years... you could try reducing the character set... – hft Aug 25 '18 at 21:38
  • @hft, good idea. If you have access to the password policy, you could for instance create masks for i.e. hashcat to limit your tries for the password policy. – Dog eat cat world Aug 26 '18 at 5:18
  • How much does onlinehashcrack charge? They don't say on their web site. – pacoverflow May 12 '19 at 9:02
3

First of all, you can look beyond just dictionary and bruteforce. There are many other approaches possible (dictionary + rules, masks, combinator attacks, hybrid attacks, etc.). The hashcat wiki and/or the John the Ripper (jumbo) MODES doc list a number of the other possible attack types.

You didn't mention what your current capability (hashes per second) is, but I'm assuming that it's either CPU-based, or using a single GPU. If it's CPU, you should try GPU (OpenCL/CUDA), which is dramatically better for some kinds of attacks. If you're already using GPU, then depending on your budget, the most cost-effective method in the time allotted would probably be to rent a GPU compute instance - Amazon, vast.ai, Google Cloud, etc. - using NVIDIA GPUs, and either hashcat or John the Ripper.

You also didn't mention which dictionaries you tried - that matters. The best wordlists are user passwords from other sources, such as the hashes.org founds lists. Using these as wordlists, and then adding rules to "mangle" them in various ways, can be very productive.

In other words, you have many additional options. If you ramp up quickly, you could cover a lot of ground in that week.

Note, however, that while these overall strategies are good at improving your cracking success rates on average ... they're no guarantee that you'll get any specific password. But if you're cracking thousands of passwords, adding these techniques will usually significantly increase your percentage of successful cracks.

Improve this answer
1
  • If hashes.org isn't available, historical founds are also cached at weakpass.com ("hashesorg2019", etc). – Royce Williams Mar 2 at 4:42
1

What I mostly use to crack NTLM and NTLMv2 hashes is Cain and Abel

![cain and abel

Cain And Abel can crack NTLM hashes with a dictonary attack, Brute-Force attack, Cryptanalysis attack and Rainbow tables. It uses CPU power and is only available for Windows.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.