Hash Cracking Techniques
Recover a passphrase from a file
Use only when the encrypted file/key is relevant to the access path. Pick the matching extractor; the output is a verifier for offline recovery, not a pass-the-hash credential.
SSH private key
python3 /usr/share/john/ssh2john.py /PATH/id_rsa > ssh-key.hash
john --wordlist=/PATH/passwords.txt ssh-key.hash
john --show ssh-key.hash
An unencrypted key does not need cracking. After recovery, use the key and passphrase with the correct account/host, not as an assumed account password.
KeePass database or password-protected ZIP
Choose the applicable file type:
keepass2john /PATH/vault.kdbx > keepass.hash
john --wordlist=/PATH/passwords.txt keepass.hash
john --show keepass.hash
zip2john /PATH/archive.zip > archive.hash
john --wordlist=/PATH/passwords.txt archive.hash
john --show archive.hash
Use the installed John Jumbo utilities. A required KeePass key file or unsupported format needs its matching prerequisite/tooling checked; No password hashes loaded is not a failed wordlist. A recovered archive/database password is not automatically valid on a host. John usage and credential-type selection.
Distinguish a reusable NT hash from a captured response
An NT hash can be used by a compatible pass-the-hash client when that account has the required access. A Net-NTLMv2 challenge/response is different: do not pass it to an NT-hash option.
hashcat -m 5600 -a 0 netntlmv2.txt /PATH/passwords.txt
hashcat -m 5600 --show netntlmv2.txt
Only use mode 5600 for a confirmed Net-NTLMv2 response format. Validate a recovered password separately; poisoning/spoofing is not part of this workflow. For NT hashes use the existing mode-1000 entry below and access prerequisites.
Cracking NT (NTLM) hashes
$ hashcat -m 1000 -a 0 hashes.txt [path/to/wordlist.txt] -o cracked.txt
$ john --wordlist=[path/to/wordlist.txt] hashes.txt
For newly requested service tickets, use the selected-account Kerberoasting and matching verifier modes.
Recover from an already exported RC4 service-ticket .kirbi file
For a service ticket whose actual encryption is RC4 etype 23, use the installed John Jumbo helper:
python3 /usr/share/john/kirbi2john.py /PATH/ticket.kirbi > ticket.hash
john --wordlist=/PATH/passwords.txt ticket.hash
john --show ticket.hash
The upstream helper emits the RC4 service-ticket format; it must not be used to relabel an AES ticket or a TGT as that format. Conversion extracts a verifier; offline cracking is a separate operation. Prefer the requesting tool's correctly formatted output when available. A recovered service-account password still needs destination-specific validation.