-1

The Task is kind of a CTF task that I was given and I have no idea how to do this.

I had to crack a password on a zipfile and then crack the 3 hashes in the txt file within the zip file. I cracked the zip fine and I used ophcrack on the txt file and got 2 of the passwords but the last one didn't work:

AF21E9412415C6F1AAD3B435B51404EE:0043E2DE58E27650FAC7CEFBE2BA22BC

I ran hash-id and this was the result:

Possible Hashs:

[+] md5($pass.$salt) - Joomla

[+] SAM - (LM_hash:NT_hash)

According to hashcat example hashes it's mode 10 so I used the following command with rockyou.txt wordlist.

hashcat -m 10 crackthis.txt rockyou.txt

Which didn't result in anything.

I checked all MD5 modes it could be with

hashcat -h | grep MD5

and it gave me a big list and I'm not sure if doing all those modes it gives me would even work.

I don't know where to go from here.

There was no information given regarding possible passwords. Just crack the zip and then crack the hashes in the zip. No other information.

1
  • 1
    You settled on just one hash type when there were 2 options? And didn't even try the 2nd? Why?
    – schroeder
    Commented May 5 at 22:16

1 Answer 1

2

This one is an LM:NTLM hash pair, how Windows stores them (the SAM). They're the "same" password, stored two different ways:

  • You can crack the first half as LM (hashcat mode 3000, case-insensitive backward-compatible storage)
  • or the second half as NTLM (hashcat mode 1000).

If you crack the first half first, you can use it as a base word to crack the second half (with potentially different case).

2
  • 1
    While I understand that the decision to close was necessary (because it's often impossible to tell the difference between synthetic passwords and real ones, a zero-tolerance policy is important), IMO this specific question was innocent. It was not about cracking the security of a specific system - it was an (understandably naive) inquiry about what kind of hash was presented, not about a specific system. As a compromise, if the hash had been obfuscated, the post could be rendered innocuous. Commented May 6 at 15:23
  • 1
    Yea I understand why it was closed. I wasn't really thinking about how this would look, I was just stuck on the task for a while and I asked question. I'll keep in mind the rules if I was to ask similar questions in the future. In regards to your answer it was correct. I just completely ignored the 2nd line of possible hashes and was thinking it was MD5. In the end I didn't even need to do it for the task as the teacher just wanted the results from Ophcrack and not the 3rd password.
    – Wrex
    Commented May 14 at 18:59

Not the answer you're looking for? Browse other questions tagged .