I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the format that FreeRadius-WPE is returning me the credentials:

username: Domain\User
    challenge: 57:82:23:55:cd:68:10:ed
    response: 6d:dc:ac:a6:1e:cb:ea:b7:7f:dc:b4:08:89:30:b6:82:6e:37:15:a4:1e:92:1f:b6
    john NETNTLM: **Domain\User:$NETNTLM$57822355cd6810ed$6ddcaca61ecbeab77fdcb4088930b6826e3715a41e921fb6**

(Most importantly is the line between **'s which is what I send to John/Asleap to crack it)

They're all NTLM v2, so I was hoping to run them through HashCat, but everything I see with HashCat involves some "lc" format that looks like this:


Where "hashcat" is the password. I found this information here.

So again, how can I convert from my strange format to this lc one so that I can use it in HashCat?

1 Answer 1


This hashcat thread claims that simply rearranging the fields should be sufficient - but hashcat only recognizes the resulting hash as NetNTLMv1, not v2.

$ cat john.hash 

$ cat john.hash | perl -ne '/(.*?):\$.*?\$(.*?)\$(.*)/; print "$1::::$3:$2\n";'

... but it's not recognized as NetNTLMv2:

$ hashcat -m 5600 --quiet -O -a 3 hashcat.hash hash?l?l?l
Hashfile 'hashcat.hash' on line 1 (Domain...e3715a41e921fb6:57822355cd6810ed): Salt-length exception
No hashes loaded.

... and I can't crack it as "hashcat" and NetNTLMv1:

$ hashcat -m 5500 --quiet -O -a 3 hashcat.hash hash?l?l?l
[no output]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.