Hashcat -m 5600 crackme.txt passwordlist. Find your favorite password list (RockYou? best_1000_passwords2018.txt?) and open a terminal to use hashcat to run:.Username::domain:ServerChallenge:NTproofstring:modifiedntlmv2response There is no separate download step required for any of the labs. Put the values into the following format and save it as crackme.txt: Many of these are derived from the SEED labs from Syracuse University.Copy this value to the text document as a Hex String. This will highlight the packet where the NTLM Server Challenge is found, generally the packet before the NTLM_Auth packet. Go to the 'Go Spelunking' section of the Wireshark download page, select the mirror site closest to you, click on the link for it, click on 'win32' or 'win64' depending on whether you want a 32-bit or 64-bit version of Wireshark, click on 'all-versions', and then click on the '.exe' file for the version you want. Notice that NTLMv2Response begins with the ntlmProofStr, so delete the ntlmProofStr from the NTLMv2Response.Copy both of these out to the text document as a Hex String.

Filter the packet down to the Security Blob layer to get to the juicy good stuff:Ĭopy out the domain name and user name to a text document.ĭrill down into the NTLM Response section to find NTProofStr and NTLMv2 response.

Filter by ntlmssp to get the authentication handshake.

pcap that contains an NTLMv2 hash in Wireshark.

Wireshark download hash