Hashcat
The hard part of hashcat is not running it but picking the right mode (-m). Here are the ones that come up most on HTB; if unsure, use hashcat --identify or the hash identifier in our resources.
- Platform
- Linux · Windows · macOS (GPU)
- Official site
- hashcat.net/hashcat/
- On HTB
- 24 machines
Install
sudo apt install hashcat- T1110.002 Password Cracking
- T1558.003 Kerberoasting
- T1558.004 AS-REP Roasting
- Hash cracking
- Kerberoasting
- AS-REP roasting
Hashcat cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Most used modes
NTLM (Windows NT hash)
hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt
NetNTLMv2 (Responder)
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
Kerberoasting (TGS-REP RC4)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
AS-REP roasting
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
sha512crypt ($6$, /etc/shadow)
hashcat -m 1800 hash.txt /usr/share/wordlists/rockyou.txt
bcrypt ($2y$, PHP web apps)
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txtAttacks
Mask (Uppercase, lowercase and 4 digits)
hashcat -m 0 hash.txt -a 3 '?u?l?l?l?l?d?d?d?d'
Hashes with the username first (user:hash)
hashcat -m 1000 --username hashes.txt /usr/share/wordlists/rockyou.txtIn our cheatsheets
JWT analyser › Attacks
hashcat
hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txtWindows and Active Directory privilege escalation › Active Directory
AS-REP roasting
impacket-GetNPUsers box.htb/ -usersfile usuarios.txt -no-pass -dc-ip 10.10.11.20 -format hashcatCrack with hashcat -m 18200.
Active Directory in depth › Impacket
AS-REP roasting
Attacker
impacket-GetNPUsers box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -format hashcat -outputfile asrep.txthashcat -m 18200
Hash identifier › Cracking
Wordlist
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
Wordlist with rules
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
Show an already cracked password
hashcat -m 0 hash.txt --show
Let hashcat guess the type
hashcat hash.txt --identifyNo command matches.
HTB machines where Hashcat is used
Taken from the chapters of IppSec videos where Hashcat shows up. The ▶ link jumps to the minute of that part.
Guides that use Hashcat
- Hash cracking with hashcat and John the Ripper: modes, rules, masks and protected files 3 min read Identify a hash, pick the right hashcat mode (NTLM, NetNTLMv2, bcrypt, Kerberos), use rules and masks, and crack zip, KeePass and SSH keys with *2john.
- Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory 3 min read What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
- Analysing a PCAP in a CTF with Wireshark and tshark 3 min read What to check first in a packet capture, how to pull FTP, HTTP, LDAP and Kerberos credentials, extract files and decrypt TLS or WiFi with Wireshark and tshark.
- JWT attacks: alg none, weak secrets, algorithm confusion and kid injection 4 min read How to read a JSON Web Token, crack its secret with hashcat, abuse alg none and RS256 to HS256 confusion, and inject into the kid and jku headers to sign your own tokens.
- MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft 3 min read Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes.