Hashing

#individual ntlm hash with rules
hashcat -m 1000 -a 0 DAE57D78FEC919471799CE0FAE8236B9 rockyou.txt -r leetspeak.rule

#ntlm hashlist  with rules
hashcat -m 1000 -a 0 hashlist2.txt rockyou.txt -r rules.txt

#sha1 hashlist  with multiple rule sets
hashcat -m 100 -a 0 hashlist2.txt rockyou.txt -r rules.txt -r best64.rule -r leetspeak.rule

#hash generator
https://codebeautify.org/ntlm-hash-generator
https://www.browserling.com/tools/all-hashes

#hashcat cheat sheet
https://cheatsheet.haax.fr/passcracking-hashfiles/hashcat_cheatsheet/

#hash dumps
http://www.adeptus-mechanicus.com/codex/hashpass/hashpass.php

#lsa dump from ram
taskmanager (admin) - details - r/c lsass.exe - create dump file
mimi sekurlsa::minidump lsass.dmp
log lsass.txt
sekurlsa::logonpasswords

#dump secrets
token::elevate
lsadump::secrets

#continue from the last checkpoint
hashcat --restore

#hashcat speed explanations
H/s == Hashes per second
KH/s == Kilohashes per second (Thousands of hashes per second)
MH/s == Megahashes per second (Millions of hashes per second)
GH/s == Gigahashes per second (Billions of hashes per second)
TH/s == Terahashes per second (Trillions of hashes per second)
PH/s == Petahashes per second (Quadrillions of hashes per second)

#brute force options
#password of 7 chars (1x uppercase x5 lowercase x1 special character) in NTLM format
hashcat -a 3 -m 1000 hashes.txt ?u?l?l?l?l?l?s

#brute force character sets
?l # Lowercase a-z
?u # Uppercase A-Z
?d # Decimals
?h # Hex using lowercase chars
?H # Hex using uppercase chars
?s # Special chars
?a # All (l,u,d,s)
?b # Binary