DΛΣMӨП

Catalog WADComs

WAD · Tool

Hashcat

6 techniques Linux · ActiveDirectory · WindowsWADComs GPL-3.0

Hashcat-ASREPRoast

NEW
Credential Access LinuxActiveDirectoryWindows

Accounts with 'Do not require Kerberos preauthentication' set will return an AS-REP whose encrypted part is derived from the account password. Hashcat mode 18200 cracks the RC4-HMAC (etype 23) $krb5asrep$23$ format produced by Impacket GetNPUsers.py or Rubeus asreproast. No valid domain credentials are needed to collect these, and cracking is fully offline against a wordlist. Command Reference: Hash File: hashes.txt Wordlist: /usr/share/wordlists/rockyou.txt

# hashes.txt holds one $krb5asrep$23$user@TEST.LOCAL:... blob per account
hashcat -m 18200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

hashcat -m 18200 hashes.txt --show
Native
Credential Access
Requires
Hash
Services
Kerberos

Hashcat-DCC2-mscash2

NEW
Credential Access LinuxActiveDirectoryWindows

Domain Cached Credentials v2 (mscash2 / DCC2) are the cached logon verifiers stored on domain-joined hosts so users can log in when the DC is unreachable, recoverable with secretsdump.py or mimikatz. Hashcat mode 2100 cracks the $DCC2$iterations#username#hash format. DCC2 uses PBKDF2 (default 10240 iterations) and cannot be passed or relayed, so offline cracking is the only path to the password; expect it to be far slower than NTLM. Command Reference: Hash File: hashes.txt Wordlist: /usr/share/wordlists/rockyou.txt

# hashes.txt holds one $DCC2$10240#john#<hash> line per cached account
hashcat -m 2100 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

hashcat -m 2100 hashes.txt --show
Native
Credential Access
Requires
Hash
Services
NTLM

Hashcat-Kerberoast-TGSREP

NEW
Credential Access LinuxActiveDirectoryWindows

Kerberoasting returns a TGS-REP whose encrypted portion is derived from the service account's password. Hashcat mode 13100 targets the RC4-HMAC (etype 23) $krb5tgs$23$ format produced by Impacket GetUserSPNs.py or Rubeus. Because the ticket is keyed to the account password, it can be recovered fully offline with a wordlist, no further contact with the DC and no lockout risk. This is the standard follow-up to any Kerberoast collection. Command Reference: Hash File: hashes.txt Wordlist: /usr/share/wordlists/rockyou.txt

# hashes.txt holds one $krb5tgs$23$*...*$... blob per SPN
hashcat -m 13100 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# recover already-cracked results from the potfile
hashcat -m 13100 hashes.txt --show
Native
Credential Access
Requires
Hash
Services
Kerberos

Hashcat-NetNTLMv1

NEW
Credential Access LinuxActiveDirectoryWindows

Legacy NetNTLMv1 responses (user::domain:LMresp:NTresp:challenge) are cracked with hashcat mode 5500. Their real value is that a NetNTLMv1 response captured against a known/forced challenge (e.g. 1122334455667788) is a DES computation over the raw NT hash, so it can be reversed to the account's NT hash rather than a password. The evilmog ntlmv1-multi tool formats the response for submission to crack.sh, which historically returned the NT hash instantly via DES rainbow tables (the public service has since been offline; the same reversal can be run locally as hashcat mode 14000 DES). The recovered NT hash then enables pass-the-hash. Command Reference: Hash File: hashes.txt Wordlist: /usr/share/wordlists/rockyou.txt

# straight dictionary crack of the NetNTLMv1 response
hashcat -m 5500 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# preferred: reverse a fixed-challenge (1122334455667788) response to the NT hash
# format it with evilmog's ntlmv1-multi, then submit to crack.sh / crack DES locally
python3 ntlmv1.py --ntlmv1 'john::TEST:...:...:1122334455667788'
Native
Credential Access
Requires
Hash
Services
NTLM

Hashcat-NetNTLMv2

NEW
Credential Access LinuxActiveDirectoryWindows

Responder, ntlmrelayx or an SMB/HTTP poisoning capture yields NetNTLMv2 challenge-response hashes in the form user::domain:challenge:HMAC:blob. Hashcat mode 5600 cracks these offline to recover the account's cleartext password. NetNTLMv2 cannot be passed-the-hash, so cracking (or relaying) is the only way to weaponise a captured response. Command Reference: Hash File: hashes.txt Wordlist: /usr/share/wordlists/rockyou.txt

# hashes.txt holds one JOHN::TEST:112233...:HMAC:blob line per capture
hashcat -m 5600 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

hashcat -m 5600 hashes.txt --show
Native
Credential Access
Requires
Hash
Services
NTLM

Hashcat-NTLM-secretsdump

NEW
Credential Access LinuxActiveDirectoryWindows

Impacket secretsdump.py, an NTDS.dit dump or a SAM dump yields lines of the form user:rid:lmhash:nthash:::. Hashcat mode 1000 cracks the raw NT hash to cleartext. The --username flag lets hashcat parse the full pwdump-style line and keep the account association in the output. Cracking is optional for lateral movement (NT hashes can be passed) but is needed to recover reusable passwords and to spot password reuse. Command Reference: Hash File: hashes.txt NT Hash: 2a3de7fe356ee524cc9f3d579f2e0aa7 Wordlist: /usr/share/wordlists/rockyou.txt

# feed the full secretsdump pwdump line and let hashcat strip the user field
hashcat -m 1000 -a 0 --username hashes.txt /usr/share/wordlists/rockyou.txt

# or crack a bare NT hash
hashcat -m 1000 -a 0 2a3de7fe356ee524cc9f3d579f2e0aa7 /usr/share/wordlists/rockyou.txt

hashcat -m 1000 --username hashes.txt --show
Native
Credential Access
Requires
Hash
Services
NTLM