Ophcrack Cheat Sheet

Windows NTLM/LM rainbow-table cracker with GUI and live CD heritage.

Passwords & CrackingntlmofflinerainbowwindowsUpdated 2026-06-02

Overview

Ophcrack recovers Windows passwords using rainbow tables for LM/NTLM hashes—fast for weak passwords when tables match the charset/length. Use on SAM/NTDS dumps you are authorized to analyze (forensics, lab AD, owned machines).

Install

sudo apt install ophcrack ophcrack-cli

Essential commands

GUI

ophcrack

CLI — single hash

ophcrack-cli -g

Crack pwdump/SAM file with tables

ophcrack-cli -d /path/to/tables -f sam.txt

ophcrack-cli -d /usr/share/ophcrack/tables_vista_free -f hashes.txt -w

Common workflows

On Linux after acquiring SAM+SYSTEM:

bkhive SYSTEM SYSTEM.hive

samdump2 SYSTEM SAM > sam.txt

ophcrack-cli -d tables_xp_free -f sam.txt

user:id:lm:ntlm:::

ophcrack-cli -d tables_vista_free -f pwdump.txt -o result.txt

If ophcrack fails, pass NTLM to hashcat

hashcat -m 1000 ntlm_only.txt rockyou.txt

Flags reference

`-d`	Tables directory
`-f`	Hash file
`-g`	Show hash format help
`-o`	Output file
`-w`	Hide usernames (wide tables)
`-t`	Table set number (CLI)

Tips

LM hashes crack quickly; modern Windows disables LM—focus on NTLM tables.
Free tables cover short passwords; purchase or generate larger tables for engagements.
Empty LM field aad3b435b51404eeaad3b435b51404ee is normal—crack the NTLM half.
For domain hashes at scale, hashcat/secretsdump + rules usually replace ophcrack.

References

https://ophcrack.org/