Holy Shuck! Weaponizing NTLM Hashes as a Wordlist

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/holy-shuck-weaponizing-ntlm-hashes-as-a-wordlist
• Blog Title: Holy Shuck! Weaponizing NTLM Hashes as a Wordlist
• Suggested Section: 🪟 Windows Hardening -> Stealing Windows Credentials (and/or Active Directory Methodology: credential cracking / Kerberoasting / NetNTLM) with a new subsection such as "Hash Shucking & NTLM NT-Candidate Attacks (Hashcat modes 27000/27100/31500/31600/35300/35400)"

🎯 Content Summary

This post presents hash shucking applied to Active Directory (AD): treating existing NTLM (NT) hashes as a wordlist in Hashcat’s NT-candidate modes to validate password reuse across slower NT-derived formats (Kerberos RC4 tickets, NTLM challenge-responses, DCC/DCC2) without first recovering plaintext passwords.

1. Concept of layered hash shucking
The post first introduces shucking using a generic layered-hash example:

• Site A stores passwords...

  🔧 Technical Details

  Trick 1 – Layered hash shucking
  Hash shucking exploits systems where an outer hash or encryption layer uses as its key an inner hash (e.g., NTLM). Instead of brute-forcing the slow outer format with human-readable passwords, the attacker builds a wordlist of inner hashes (such as NT hashes) and feeds those directly to specialized cracking modes. For each inner-hash candidate, the tool derives the outer hash/encryption according to the target algorithm and compares it. A match confirms password reuse without knowing the plaintext, effectively stripping off the outer layer and leaving only the fast inner hash to attack or use directly.

  
  

  Trick 2 – Using NT hashes as a global AD wordlist
  In AD, the NT hash is MD4(UTF-16LE(password)) and is reused as the key material for multiple protocols: NTLM challenge-responses, Kerberos RC4-HMAC (etype 23) tickets, and DCC/DCC2 cached credentials. The trick is to treat every NT hash from one or more do...

  🤖 Agent Actions

  Summary:

  • Added a new “Hash Shucking & NT-Candidate Attacks” section to src/windows-hardening/active-directory-methodology/README.md, covering how to build NT hash corpora, use Hashcat NT-based modes (27000/27100/31500/31600/35300/35400), and leverage cross-domain Kerberoast and cached-credential shucking for rapid password-reuse validation and PtH operations, plus defensive guidance.
  • Updated the References section with citations to the TrustedSec “Holy Shuck!” blog post and the Hashcat project.

  Tests: Not run (not requested).

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/holy-shuck-weaponizing-ntlm-hashes-as-a-wordlist

Content Categories: Based on the analysis, this content was categorized under "🪟 Windows Hardening -> Stealing Windows Credentials (and/or Active Directory Methodology: credential cracking / Kerberoasting / NetNTLM) with a new subsection such as "Hash Shucking & NTLM NT-Candidate Attacks (Hashcat modes 27000/27100/31500/31600/35300/35400)"".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0