> For the complete documentation index, see [llms.txt](https://xedex.gitbook.io/internalpentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://xedex.gitbook.io/internalpentest/internal-pentest/active-directory/initial-attack-vectors/llmnr-nbt-ns-poisoning/intercept-and-hashcat.md).

# Intercept and Hashcat

Using [Responder](https://github.com/lgandx/Responder), we can make this attack happen using this command :

```
python responder.py -I <interface> -rdwv
```

Now you should see some hashes (NTLMv2) captured. The captured hashes are output into the logs file of Responder (/usr/share/responder/logs)\
At this point, you have two options, either relay the hash to try and have an open session (we'll see that in the next page) or you can take the hash and try to crack it offline by running [hashcat](https://github.com/hashcat/hashcat) on it using the following command (depending on where you're running it, its best to run it on your host system) :

```
hashcat -m 5600 hashes.txt dictionary.txt
```

You can use the following cheat sheet for more infos on how to use hashcat

{% file src="/files/-M0cIcgoJnA1XHwEfEyU" %}
Hashcat Cheat sheet
{% endfile %}