Recover a password from a captured NTLM response

Needs: Correct challenge/response formatting and feasible candidates; acquisition method must fit the allowed context

Shell commands

# Baseline
hashcat -a 0 -m 5600 netntlmv2.hash wordlist.txt
john --format=netntlmv2 --wordlist=wordlist.txt netntlmv2.hash

A Net-NTLMv2 response is not an NT hash and cannot be supplied to -H or -hashes. Relay forwards a live authentication exchange and requires received/coerced authentication, compatible protocols, signing/channel-binding conditions and useful rights.

The OSCP+ exam prohibits spoofing, including NBNS. Do not use Responder poisoning on the exam. Keep capture/relay work to explicitly authorized labs and recheck the current guide.

Verify → Retain response provenance and recovered account/password mapping; confirm relevant login rights separately.

If it fails → Incomplete captures or wrong separators break recovery. Prohibited spoofing/poisoning workflows are not an operational exam acquisition method. More detail ↓

If → then

A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state
A supported stored verifier or converted protected artifact → Recover passwords with feasible dictionary, rule and mask attacks
Needs: Correct format/mode, complete salt/context, justified candidates and an available offline tool/backend
Domain credentials or a domain-joined foothold → Establish domain identity, DC, DNS, time and route
Needs: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Recover a password from a captured NTLM response

USE WHEN: A complete challenge-response record
STARTING ACCESS: A credential artifact with a recorded source and possible account context
RESULT: A recovered password from the response's offline verifier

Recognize the clue

Use the saved authorized capture's structure and source context; inspect username/domain/challenge/response fields before selecting recovery.

head -n 2 responses.txt

SYNTHETIC EXAMPLE OUTPUT

USER::DOMAIN:SERVER_CHALLENGE:NT_PROOF:BLOB

Means: A challenge-bound response supports its appropriate offline verification workflow; it is not the long-term NT hash.

Confirm: Check complete capture format, account mapping and feasible candidates; acquisition/relay policy is a separate issue.

After validation: A complete supported record permits offline recovery and later password validation.
Ruled out in this context: Using this response directly as an NT hash is the wrong mechanism: reject that authentication attempt.
Still inconclusive: Truncated challenge/blob fields cannot support a valid recovery conclusion.

Troubleshooting: Incomplete captures or wrong separators break recovery. Prohibited spoofing/poisoning workflows are not an operational exam acquisition method.

Additional prerequisite checks

hashcat -m 5600 responses.txt WORDLIST

A Net-NTLMv2 response is not an NT hash and cannot be supplied to -H or -hashes. Relay forwards a live authentication exchange and requires received/coerced authentication, compatible protocols, signing/channel-binding conditions and useful rights.

The OSCP+ exam prohibits spoofing, including NBNS. Do not use Responder poisoning on the exam. Keep capture/relay work to explicitly authorized labs and recheck the current guide.

Why it works

The captured response is bound to its challenge and exchange. It is not an NT hash for direct Pass-the-Hash; relay is a separate live protocol mechanism with additional policy and signing prerequisites.

Worked example · hypothetical

Observation: a complete response capture is available from an authorized lab record. Test: run the correct offline mode. Illustrative output: a password is recovered. Interpretation: validate its account context rather than feeding the response to a hash-authentication client.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗