Hashcat

GPU-accelerated password cracker. Takes hashes from every other tool you run (Responder, Rubeus, Mimikatz, secretsdump) and recovers the plaintext passwords.

Linux Windows CPTS

LevelBeginner. Running a wordlist attack is easy; picking the right hash mode is the skill.

Know firstWhat a hash is (a one-way fingerprint of a password), and where yours come from: Responder, Kerberoasting or secretsdump.

You will learn topick the right mode number for a hash, run a wordlist attack with rules, and read the result.

What is it?

Hashcat is a password cracker. You give it a hash and a wordlist, and it tries every word until one matches. It uses your GPU, making it orders of magnitude faster than CPU-based tools like John the Ripper.

Every hash type has a mode number (-m). Hashcat supports hundreds of hash types, the ones you'll use during CPTS are:

Mode	Hash type	Where you get it	Speed (rough)
`1000`	NTLM (NT hash)	Mimikatz, secretsdump, SAM dump	Very fast (billions/sec)
`5600`	NTLMv2 (Net-NTLMv2)	Responder, ntlmrelayx	Moderate (millions/sec)
`13100`	Kerberoast (TGS-REP etype 23)	Rubeus kerberoast, GetUserSPNs.py	Fast (millions/sec)
`18200`	AS-REP (etype 23)	Rubeus asreproast, GetNPUsers.py	Fast
`19600` / `19700`	Kerberoast AES (etype 17 / etype 18)	Rubeus kerberoast (AES domains)	Very slow
`3200`	bcrypt	Web app databases	Extremely slow
`1800`	sha512crypt ($6$)	Linux /etc/shadow	Slow
`500`	md5crypt ($1$)	Older Linux /etc/shadow	Moderate
`0`	MD5	Web apps, databases	Very fast

Run this first

You need two things: the hash mode and a wordlist. NTLMv2 hashes captured by Responder are mode 5600.

bash: your first crack

$ hashcat -m 5600 ntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt

-m 5600 is the hash mode. It must match the hash type, so check the format first.
ntlmv2_hashes.txt is the file of hashes.
rockyou.txt is the wordlist.

A cracked hash appears as hash:password. Run the same command with --show to print results already stored in the potfile. To see an example hash for a mode, run hashcat -m 5600 --example-hashes.

output: a successful crack

JSMITH::CORP:1122334455667788:aabbccdd11223344...:Summer2024!  <-- username, then the plaintext password after the last colon

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)

What does it do?

Hashcat has several attack modes:

Mode	Flag	What it does	When to use
Straight (wordlist)	`-a 0`	Tries every word in the wordlist	First attempt. Always start here
Combination	`-a 1`	Combines words from two wordlists	When wordlist alone doesn't crack
Brute-force / Mask	`-a 3`	Tries all combinations matching a pattern	When you know the password pattern
Rule-based	`-a 0 -r rules`	Applies mutations to each wordlist word	After straight attack fails. This is where most cracks happen

Rules are where most cracks happen. A rule like $1 appends "1" to every word, c capitalizes the first letter, $! appends "!". Combined: password → Password1!. The best64.rule ships with hashcat; the much larger OneRuleToRuleThemAll.rule is a separate download (NotSoSecure's GitHub) that most CPTS labs expect you to already have.

When do you use it?

Any time you have a hash. The real question is: should you crack it or pass it?

Hash type	Crack or pass?	Why
NT hash (from Mimikatz/secretsdump)	Pass it: unless you need the plaintext for RDP or a web login	Pass-the-hash works with evil-winrm, psexec, smbclient. Cracking takes time
NTLMv2 (from Responder)	Must crack	NTLMv2 is a challenge-response: cannot be passed. Crack or relay it
Kerberoast / AS-REP	Must crack	These are encrypted service tickets, not passable hashes
Linux shadow hash	Must crack	No pass-the-hash equivalent for Linux

How do you identify the hash type?

Hash format → Hashcat mode

31d6cfe0d16ae931b73c59d7e0c089c0 (32 hex chars) → NT hash, -m 1000
user::DOMAIN:challenge:response:... → NTLMv2, -m 5600
$krb5tgs$23$*... → Kerberoast RC4, -m 13100
$krb5asrep$23$... → AS-REP, -m 18200
$krb5tgs$17$... → Kerberoast AES128, -m 19600
$krb5tgs$18$... → Kerberoast AES256, -m 19700
$6$salt$hash → sha512crypt, -m 1800
$1$salt$hash → md5crypt, -m 500
$2b$10$... or $2a$... → bcrypt, -m 3200

When you don't recognize the format

Use hashcat --identify hash.txt or the website hashes.com/en/tools/hash_identifier to identify unknown hash types. Or check Hashcat's example hashes page for a visual reference of every format.

How do you use it?

Basic syntax

bash

# The pattern: hashcat -m MODE hashfile wordlist
$ hashcat -m MODE hashes.txt /usr/share/wordlists/rockyou.txt

The hashes you'll crack most

bash: CPTS hash cracking cheatsheet

# NTLMv2 from Responder
$ hashcat -m 5600 ntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt

# Kerberoast hashes from Rubeus
$ hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

# AS-REP roast hashes
$ hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# NT hashes from Mimikatz / secretsdump
$ hashcat -m 1000 nt_hashes.txt /usr/share/wordlists/rockyou.txt

# Linux shadow file
$ hashcat -m 1800 shadow_hashes.txt /usr/share/wordlists/rockyou.txt

Using rules

bash

# Wordlist + best64 rules (quick, covers common mutations)
$ hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# OneRuleToRuleThemAll: far larger than best64, so slower and more thorough
# Not included with hashcat, clone it first: git clone https://github.com/NotSoSecure/password_cracking_rules
$ hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt -r password_cracking_rules/OneRuleToRuleThemAll.rule

# What rules do: password → Password, Password1, Password!, password123, P@ssword, etc.

Mask attacks (pattern-based)

bash

# ?u = uppercase, ?l = lowercase, ?d = digit, ?s = special

# Common corporate pattern: Word + 4 digits (Company2024)
$ hashcat -m 1000 hashes.txt -a 3 '?u?l?l?l?l?l?l?d?d?d?d'

# Season + Year + special: Summer2024!
$ hashcat -m 1000 hashes.txt -a 3 '?u?l?l?l?l?l?d?d?d?d?s'

# All 8-character combinations (slow but exhaustive)
$ hashcat -m 1000 hashes.txt -a 3 '?a?a?a?a?a?a?a?a'

Useful flags

bash

# Show cracked passwords
$ hashcat -m 13100 hashes.txt --show

# Force CPU if no GPU (Kali VM)
$ hashcat -m 13100 hashes.txt rockyou.txt --force

# Increase workload for faster cracking
$ hashcat -m 13100 hashes.txt rockyou.txt -w 3

# Output cracked hashes to a file
$ hashcat -m 13100 hashes.txt rockyou.txt -o cracked.txt

# Show potfile (all previously cracked hashes)
$ hashcat -m 13100 hashes.txt --show --potfile-path ~/.local/share/hashcat/hashcat.potfile

What do you do with cracked passwords?

Try them everywhere: Password reuse is the #1 finding in pentests. Try the cracked password on every machine, every service, every user
RDP: xfreerdp /v:TARGET /u:user /p:password
WinRM: evil-winrm -i TARGET -u user -p password
SMB: crackmapexec smb 10.10.10.0/24 -u user -p password (spray across the subnet)
Web apps: Try the same password on any web login portals you found
Service accounts (Kerberoast): Check if the account has admin rights, delegation, or interesting group memberships in BloodHound

CrackMapExec for password spraying

After cracking one password, use CrackMapExec to spray it across the network: crackmapexec smb 10.10.10.0/24 -u user -p 'Password123!'. A (Pwn3d!) result means you have local admin on that machine.

Common mistakes

Things that go wrong

Wrong mode number: Using -m 1000 on an NTLMv2 hash (or vice versa) wastes time and finds nothing. Always check the hash format first
Only using rockyou.txt: For CPTS, rockyou.txt is usually enough. But add rules, rockyou.txt + best64.rule catches 90% of passwords that plain rockyou misses
Cracking when you can pass: If you have an NT hash, try pass-the-hash first (evil-winrm -H, psexec.py -hashes). Don't waste time cracking if you can use the hash directly
No GPU in Kali VM: Hashcat in a VM without GPU passthrough is slow. Use --force to run on CPU, but consider running Hashcat on your host machine with a GPU instead
Forgetting --show: Hashcat stores cracked hashes in a potfile. If you run the same hash twice, it says "already cracked." Use --show to see the result
Not trying variations of cracked passwords: If you crack Summer2023!, manually try Summer2024!, Winter2023!, Fall2023!. People follow patterns

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

Which hash modes do you use for NTLMv2, Kerberoast RC4 and AS-REP?

5600, 13100 and 18200.

You crack Summer2023! for one account. What do you try next?

Variations of it, such as Summer2024!, Winter2023! and Fall2023!. People follow patterns.

You already have an NT hash. Why might cracking be the wrong move?

You can often use the hash directly (pass-the-hash with evil-winrm -H or psexec.py -hashes), which skips cracking entirely.

You run the same hash twice and hashcat says it is already cracked. How do you see the password?

Add --show. Hashcat stores cracked hashes in a potfile and does not crack them again.

Why add a rules file such as best64 to a rockyou attack?

Rules mutate every word (append a digit, capitalize, add a !), so they catch variations that plain rockyou misses. best64.rule ships with hashcat.

What do the mask characters ?u ?l ?d ?s stand for?

Uppercase letter, lowercase letter, digit and special character. ?u?l?l?l?l?l?d?d?d?d matches patterns like Summer2024.