I have an old Windows domain SMB sniffer file circa 1998 and just out of interest I want to see if I can crack it now with John The Ripper. I believe the file was generated using the L0phtCrack SMB Packet Capture feature. The format of the file is a list of entries such as:


The format appears to be:

DOMAIN\username:3:SMB challenge:encrypted LANMAN hash:encrypted NTLM hash

Not sure what the first 3 bytes are but it is the same for all entries. This probably uses some defunct Windows NT authentication method with the 8-byte challenge and 24-byte responses.

I cannot open the file as is natively with John. So I would like to know if I can either specify some options or reformat the file so that I can open it in John The Ripper.

  • Hashcat doesn't think it's a valid hash... Hashfile 'crackme.txt' on line 1 (CADE\i...1c65d2cf9c9d4d5084bb8f8416a94adb): Token length exception No hashes loaded.
    – gowenfawr
    Commented Jun 18, 2021 at 14:39

1 Answer 1



Clean up your data to just have:


That works on my end with john, probably will work with hashcat as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .