CyberCheatsheets

Ophcrack Cheat Sheet

Windows NTLM/LM rainbow-table cracker with GUI and live CD heritage.

Passwords & CrackingntlmofflinerainbowwindowsUpdated 2026-06-02

Overview

Ophcrack recovers Windows passwords using rainbow tables for LM/NTLM hashes—fast for weak passwords when tables match the charset/length. Use on SAM/NTDS dumps you are authorized to analyze (forensics, lab AD, owned machines).

Install

sudo apt install ophcrack ophcrack-cli

Essential commands

GUI

ophcrack

CLI — single hash

ophcrack-cli -g

Crack pwdump/SAM file with tables

ophcrack-cli -d /path/to/tables -f sam.txt
ophcrack-cli -d /usr/share/ophcrack/tables_vista_free -f hashes.txt -w

Common workflows

On Linux after acquiring SAM+SYSTEM:

bkhive SYSTEM SYSTEM.hive
samdump2 SYSTEM SAM > sam.txt
ophcrack-cli -d tables_xp_free -f sam.txt

user:id:lm:ntlm:::

ophcrack-cli -d tables_vista_free -f pwdump.txt -o result.txt

If ophcrack fails, pass NTLM to hashcat

hashcat -m 1000 ntlm_only.txt rockyou.txt

Flags reference

-d

Tables directory

-f

Hash file

-g

Show hash format help

-o

Output file

-w

Hide usernames (wide tables)

-t

Table set number (CLI)

Tips

  • LM hashes crack quickly; modern Windows disables LM—focus on NTLM tables.
  • Free tables cover short passwords; purchase or generate larger tables for engagements.
  • Empty LM field aad3b435b51404eeaad3b435b51404ee is normal—crack the NTLM half.
  • For domain hashes at scale, hashcat/secretsdump + rules usually replace ophcrack.

References

Chuletas relacionadas