search

HashPals / Name-That-Hash

🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥
https://nth.skerritt.blog
GNU General Public License v3.0
1.46k stars 103 forks source link

Problem identifying windows xp ntlm hashes #147

Open Kyu opened 12 months ago

Kyu commented 12 months ago 
cat cracking4.txt
21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823
11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C
65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285
FBBDA33FC12E83FB0C240E84A183686E:DDE9DC6E34E2E6E11EF9E51C6B27ED96
21C4E7C2EFE8E8D1C00B70065ED76AA7:A7A0F9AFD4A78F531A1CF4C42E531BBF
E85B4B634711A266AAD3B435B51404EE:FD134459FE4D3A6DB4034C4E52403F16
BA756FB317B622DBAAD3B435B51404EE:C8405270B10B13AE8A24612BB853567A
199C926FA387EAB7AAD3B435B51404EE:F196F77BF8BB15781BA8364C649C5FD4
FE4AACAAAD7D986AAAD3B435B51404EE:3928E16F614E2316CA51C336FA5B3011
3613F7EC15407F56AAD3B435B51404EE:C82E164316183AA3AF3EA6BAA642A237

nth -f cracking4.txt
# Truncated for readiblilty 
21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

However, these can be cracked using 1000 mode in hashcat (after truncating the first part of the string with delimiter as :)