Rainbow Tables

Prompt

Our analysts have obtained password dumps storing hacker passwords from some old Windows servers that are run by the Liber8tion criminal group. Can you crack these passwords?

Walk-Through

This challenge involves cracking Windows NTLM passwords. The questions for this challenge can be solved using ophcrack with the XP free fast wordlist.

Setting up ophcrack

When you download the XP free fast list, it only contains alphanumeric characters (letters and numbers) in the wordlist. The XP special list will include special characters in addition to everything included in the XP free fast list.

ALL files for a particular wordlist should be downloaded, unzipped and saved to a folder with the wordlist name.

Ophcrack can run on both Linux and Windows. Opchcrack is pre-installed on Kali Linux. Windows may try to block the use of ophcrack because the program functions similar to some viruses.

For the wordlist files, use the md5sum.txt file to check that you have the correct files downloaded.

Run the ophcrack GUI program. Select ‘Tables’ from the top menu. Select which table you want to use, click ‘Install’, and then navigate to the folder where you saved the wordlist.

When done correctly, the red button next to the wordlist will turn green.
When done correctly, the red button next to the wordlist will turn green.
You are now ready to crack passwords with ophcrack!
You are now ready to crack passwords with ophcrack!

Guide

You can load in each hash individually using the “Load > Single Hash” option or you can save all of the hashes into a text file and then select the “Load > PWDUMP file” option to load all of the hashes at once.

Select which option you want to use.
Select which option you want to use.

Once hashes are loaded, press ‘Crack’.

image

Below is output from ophcrack after cracking is completed. Use answers from the ‘NT Pwd’ column as these include the lowercase characters that are part of the password. LM hashes will only show uppercase (regardless of the actual case).

Most of the answers are redacted. Remember to use the output from the ‘NT Pwd’ column as this contains the case sensitive version of the password.
Most of the answers are redacted. Remember to use the output from the ‘NT Pwd’ column as this contains the case sensitive version of the password.

Useful resources for this challenge:

Tutorial Video

Watch our full Tutorial Video to learn more specifics about rainbow tables, using ophcrack, and see a walkthrough of how to solve this challenge:

Questions

1. 3DD1FBC27831C5F37C3113B4A1A5E3A0:AFEFFCDAAF0662AD320CEB423C9A160D

2. FA4F6C499D7A1598BB738DDACC45834C:BAE8A18E6A5CA516465279CCA50E8D36

3. B253395EF2B08A3C5D066BE4D31DBA16:64757A073C44C714F6FE0F07E11F9082

4. FA8A4C51567993309C5014AE4718A7EE:1F4FD09BE84B20FE891FB93A60F61499

5. DBC12B38AA32A681F58CFA8E98E4E5B6:86178E8EADE411AF3DB1446D8082289F

6. 93AF3851019BC8C793E28745B8BF4BA6:506DD82C015DEEE0CDDDC5DAC449E1AB

©️ 2026 Cyber Skyline. All Rights Reserved. Unauthorized reproduction or distribution of this copyrighted work is illegal.