TL;DR: Once you have NTLM hashes – from a SAM dump, secretsdump, or Responder capture – Hashcat can recover plaintext passwords offline in minutes. Use mode
-m 1000for NTLM and-m 5600for NTLMv2 (Net-NTLMv2). Start with a dictionary attack againstrockyou.txt, layer on rules (best64.rule), and escalate to hybrid or brute-force if needed. Never send hashes to an online cracker on a real engagement.
Introduction
Credential-based attacks win networks. Once you have a foothold and can dump hashes – from a local SAM database, a domain controller via secretsdump, or a poisoned LLMNR/NBT-NS response via Responder – the next step is turning those hashes into usable plaintext passwords.
NTLM hashes don’t travel over the wire in most modern environments, but they’re still everywhere on disk. A domain joined host keeps a local copy of every cached credential in the SAM hive. Domain controllers hold every user’s NTLM hash in NTDS.dit. Password reuse means that one cracked hash often unlocks lateral movement across the entire environment.
Hashcat is the industry-standard GPU-accelerated password recovery tool. It runs against local hardware – no data leaves your machine – and can test billions of candidates per second against NTLM, which has no salting and no iteration count by design. This guide walks you through the full workflow from hash to plaintext.
Tools Required
| Tool | Notes |
|---|---|
| Hashcat | v6.2.6+ recommended. hashcat.net |
| GPU (recommended) | NVIDIA (CUDA) or AMD (OpenCL). A single RTX 3080 does ~70 GH/s on NTLM. CPU fallback works but is ~100x slower. |
| rockyou.txt | Included in Kali (/usr/share/wordlists/rockyou.txt.gz). ~14 million entries. |
| SecLists | Extended wordlists at /usr/share/seclists/Passwords/ on Kali, or from GitHub. |
| GPU drivers | NVIDIA: CUDA Toolkit. AMD: ROCm or OpenCL drivers. Must match your Hashcat binary. |
Install on Kali (if not present):
sudo apt update && sudo apt install -y hashcat
gunzip /usr/share/wordlists/rockyou.txt.gzStep-by-Step Instructions
Step 1 – Identify Your Hash Type
NTLM and Net-NTLMv2 look similar but require different Hashcat modes and cannot be cracked with each other’s mode.
| Hash Type | Hashcat Mode | Example Format |
|---|---|---|
| NTLM (local/domain) | -m 1000 | aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 |
| Net-NTLMv2 (Responder) | -m 5600 | user::DOMAIN:challenge:hash:blob |
A pure NTLM hash is 32 hex characters (the LM portion before the colon can be ignored – it’s often a blank LM placeholder). If you captured hashes with Responder or Inveigh, those are Net-NTLMv2 and require mode 5600.
To check which mode you need, look at the hash structure:
- Short 32-char hex string → NTLM (
-m 1000) - Long colon-delimited string with username and challenge → Net-NTLMv2 (
-m 5600)
Step 2 – Prepare Your Hash File
One hash per line. For NTLM, you can include just the NT hash (right side of the colon) or the full LM:NT string – Hashcat handles both.
# hashes.txt
31d6cfe0d16ae931b73c59d7e0c089c0
aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586cStep 3 – Dictionary Attack
Start here. Dictionary attacks against rockyou.txt recover a surprisingly high percentage of real-world hashes in under a minute.
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txtFlags:
-m 1000– NTLM hash mode-a 0– dictionary (straight) attack modehashes.txt– your hash file/usr/share/wordlists/rockyou.txt– candidate wordlist
Watch output: Hashcat prints speed (H/s), estimated time, and cracked count. Results are saved automatically to the potfile (~/.hashcat/hashcat.potfile).
Step 4 – Rule-Based Attack
Rules transform wordlist candidates on the fly: add numbers, append symbols, toggle case, and more. best64.rule ships with Hashcat and covers the most common real-world mutations.
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt \
-r /usr/share/hashcat/rules/best64.ruleFor broader coverage, chain multiple wordlists or use the OneRuleToRuleThemAll project rules.
Step 5 – Hybrid Attack
Hybrid attacks combine a wordlist with a mask (pattern). Use this when you suspect passwords like Password2024! or Summer@23.
# Wordlist + suffix mask: word followed by 1-4 digits then one symbol
hashcat -m 1000 -a 6 hashes.txt /usr/share/wordlists/rockyou.txt '?d?d?d?d'Mask charset shortcuts:
?d– digit (0–9)?l– lowercase letter?u– uppercase letter?s– special character?a– all of the above
Step 6 – Check Results and Restore
Show all cracked hashes from the potfile at any time:
hashcat -m 1000 hashes.txt --showIf a long session is interrupted, restore it:
hashcat --restoreHashcat writes a .restore file automatically when you interrupt with Ctrl+C during a run.
Example Outputs
During a run:
Session..........: hashcat
Status...........: Running
Hash.Mode........: 1000 (NTLM)
Hash.Target......: hashes.txt
Time.Started.....: Thu Apr 3 14:22:01 2026 (0 secs)
Speed.#1.........: 9876.3 MH/s (4.12ms) @ Accel:128 Loops:1024 ...
Recovered........: 1/4 (25.00%) Digests (total), 1/4 (25.00%) ...
Progress.........: 14344385/14344385 (100.00%)After --show:
31d6cfe0d16ae931b73c59d7e0c089c0:
8846f7eaee8fb117ad06bdd830b7586c:Password1The hash on the left, the plaintext to the right of the colon. An empty plaintext (first line) is a blank password.
Common Mistakes
Wrong hash mode. Using -m 1000 on a Net-NTLMv2 hash (or vice versa) produces zero results with no error. Always confirm format before running.
GPU driver mismatch. Hashcat silently falls back to CPU – or crashes – if CUDA/OpenCL drivers aren’t installed or don’t match the binary. Run hashcat -I to list detected devices and confirm your GPU appears.
Wordlist encoding issues. rockyou.txt has some non-UTF-8 lines that can cause warnings. Pass --force only as a last resort; first try --encoding-from=utf8 or strip bad lines with strings rockyou.txt > rockyou_clean.txt.
Forgetting --show after a completed session. Hashcat doesn’t re-display cracked hashes on startup – it skips already-potted hashes. Always run with --show to review the full results set.
Running against the full LM:NT string when only NT matters. If your hash file contains aad3b435b51404ee:..., the LM placeholder is fine to leave in – Hashcat mode 1000 reads only the NT portion – but double-check with a known hash before a long run.
Summary
Cracking NTLM hashes offline is one of the highest-ROI steps in a credential-based intrusion path. The workflow is straightforward: dump hashes, confirm the type (NTLM mode 1000 vs. NTLMv2 mode 5600), run a dictionary attack against rockyou.txt, layer on rules for mutation coverage, and escalate to hybrid or brute-force if the target password doesn’t appear in common wordlists. GPU acceleration makes NTLM – an intentionally fast, unsalted hash – trivially crackable for any password shorter than ten characters and common enough to appear in wordlists. Use the potfile and restore features to manage long sessions, and always verify results with --show before concluding a run.