For testing NTLMRawUnhide I captured a NTLMv2 challenge in my AD lab for a user I had created with a password from rockyou.txt

The password was cracked without problems by John the Ripper, but hashcat 6.1.1 wouldn't crack it.

After some testing testing I found that the backslash in the username field was the problem.

Changing it from ADLAB\dabob::DC01:30d31bd5(...) to dabob::ADLAB:30d31bd5(...) or dabob::DC01:30d31bd5(...) made hashcat crack the hash without problems.

Looking at the hashcat example hashes at https://hashcat.net/wiki/doku.php?id=example_hashes, the username field there contains only the username, not the domain.

Attached

The attached file, files.zip contains the following:

• trace.etl: the capture I ran NTLMRawUnhide on
• hashes.txt: The file output by NTLMRawUnhide, which JtR did crack, but not hashcat
• hashes_modified.txt: The modified file that were cracked by both JtR and hashcat

This works well, and it runs for a while using
python NTLMRawUnHide.py -i tsharkoutput.pcapng -f -o tsharkhashes.txt
It finds and saves some hashes, but eventually fails with the following:

Traceback (most recent call last):
File "c:\apps\NTLM\NTLMRawUnHide.py", line 413, in
main(sys.argv[1:])
File "c:\apps\NTLM\NTLMRawUnHide.py", line 408, in main
searchCaptureFile(infile, outfile, verbose, follow, quiet, 0)
File "c:\apps\NTLM\NTLMRawUnHide.py", line 263, in searchCaptureFile
searchCaptureFile(infile, outfile, verbose, follow, quiet, last_byte)
File "c:\apps\NTLM\NTLMRawUnHide.py", line 263, in searchCaptureFile
searchCaptureFile(infile, outfile, verbose, follow, quiet, last_byte)
File "c:\apps\NTLM\NTLMRawUnHide.py", line 263, in searchCaptureFile
searchCaptureFile(infile, outfile, verbose, follow, quiet, last_byte)
[Previous line repeated 990 more times]
File "c:\apps\NTLM\NTLMRawUnHide.py", line 92, in searchCaptureFile
with open(infile, 'rb') as fp:
RecursionError: maximum recursion depth exceeded while calling a Python object.

packets are captured in a separate (root) terminal using
tshark -a filesize:1000000 -i 7 -f "tcp port 445" -F pcapng -w tsharkoutput.pcapng