Recover a password from cached domain logon verifiers

Needs: Correct username/salt/iteration context and feasible offline candidates

Shell commands

# Baseline
hashcat -hh | grep -i 'Domain Cached'
john --format=mscash2 --wordlist=wordlist.txt dcc2.hash

Verify → Confirm artifact format, account mapping and current password acceptance.

If it fails → No recovery does not disprove account existence; stale cached credentials may fail current online authentication. More detail ↓

If → then

A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state
Domain credentials or a domain-joined foothold → Establish domain identity, DC, DNS, time and route
Needs: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew
A supported stored verifier or converted protected artifact → Recover passwords with feasible dictionary, rule and mask attacks
Needs: Correct format/mode, complete salt/context, justified candidates and an available offline tool/backend

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Recover a password from cached domain logon verifiers

USE WHEN: A DCC2/MSCache record from matched SECURITY/SYSTEM material
STARTING ACCESS: A credential artifact with a recorded source and possible account context
RESULT: A recovered domain password, subject to current account state

Recognize the clue

Inspect SECURITY/SYSTEM parser output and distinguish cached-domain logon verifiers from local SAM hashes and service secrets.

head -n 3 dcc2.txt

SYNTHETIC EXAMPLE OUTPUT

$DCC2$ITERATIONS#USER#VERIFIER

Means: The DCC2 structure and username-associated derivation identify offline cached-logon material.

Confirm: Verify iteration/username context, source consistency and current online account state after any recovery.

After validation: A complete supported record and feasible candidates enable the DCC2 recovery workflow.
Ruled out in this context: DCC2 is not accepted directly as an NTLM long-term hash: reject that reuse route.
Still inconclusive: A recovered old password may be stale; validate current account acceptance without assuming extraction failed.

Troubleshooting: No recovery does not disprove account existence; stale cached credentials may fail current online authentication.

Additional prerequisite checks

hashcat -m 2100 dcc2.txt WORDLIST

Preserve the username because it participates in the verifier. DCC2 is an offline recovery target, not ordinary PtH material.

Why it works

Cached interactive-logon verifiers support offline logon checks; they are not reusable NT hashes. Their derivation makes cracking materially different from NT recovery.

Worked example · hypothetical

Observation: cached domain data is extracted. Test: classify it before selecting a tool mode. Illustrative output: DCC2 is identified and one password is recovered. Interpretation: validate against the live domain; the cached value may be stale.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗