What format do the NTDS dump and potfile need to be in?

[danti1988]

NTDS

Straight secretsdump or dsinternals output. Colon separated, at least four fields:

DOMAIN\username:RID:LMHASH:NTHASH:::
CONTOSO\j.smith:1104:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

The DOMAIN\ prefix is optional on a single domain, but you want it on multi domain work because it's used to partition hashes to the right domain. Both aad3b435b51404eeaad3b435b51404ee and no lm-hash********************** are understood as "no LM hash", so either is fine.

Potfile

Standard hashcat potfile. The line is split on the last colon, so everything before it is the hash and everything after is the password:

8846f7eaee8fb117ad06bdd830b7586c:Summer2024!

Mode 1000 lines match on the NT hash. NetNTLMv2 lines from mode 5600 are picked up too and handled separately.

j.smith::CONTOSO:1122334455667788:a1b2...:0101...:Summer2024!