ophcrack-cli: Cracks Windows passwords using LM/NT hashes

Ophcrack is a free, open-source Windows password cracker that uses rainbow tables — precomputed hash-to-plaintext lookup tables — to recover Windows LM (LAN Manager) and NTLM password hashes extremely quickly, without needing to perform brute-force computation at crack time. It was originally developed by Objectif Sécurité and became especially famous in the mid-2000s for being able to crack most alphanumeric Windows LM-hashed passwords in seconds to minutes using free rainbow tables.

Ophcrack has both a graphical interface (the primary way it’s normally used) and a command-line interface (ophcrack-cli) for scripted/headless use, which is what Kali Linux packages emphasize. It can load hashes directly from a local SAM file (using the bundled samdump2 utility), from a PWDUMP-format file, or by sniffing hashes live from memory on a bootable Ophcrack LiveCD (a separate distribution built specifically for this purpose). Because LM hashes are case-insensitive and split into two 7-character halves, they are dramatically weaker than NTLM, and rainbow tables are extraordinarily effective against them — which is precisely why modern Windows disables LM hash storage by default. Against pure NTLM hashes without LM, Ophcrack is far less effective and modern tools like Hashcat are generally preferred.

Key Features

• Rainbow-table-based lookup — near-instant cracking once tables are loaded, no per-hash brute-force needed
• GUI (ophcrack) and CLI (ophcrack-cli) interfaces
• Free rainbow tables available for download (XP LM tables, Vista/7 NTLM “free small” tables) plus larger paid tables from Objectif Sécurité
• Can load hashes directly from a Windows SAM/SYSTEM file pair
• Companion bootable LiveCD ISO for extracting hashes from an offline Windows installation
• Progress and success-rate statistics during a table-based crack

Installation

Ophcrack (GUI and CLI) is available in the Kali repositories:

sudo apt update
sudo apt install ophcrack ophcrack-cli -y

Verify:

ophcrack-cli -h

Download rainbow tables (not bundled by default due to size — tables range from tens of MB to tens of GB):

# Example: download the free XP LM "small" table set
wget https://ophcrack.sourceforge.io/tables/tables_xp_free_fast.zip -O xp_free_fast.zip
unzip xp_free_fast.zip -d /usr/share/ophcrack/tables/xp_free_fast

(Table download URLs change over time — check the Ophcrack SourceForge page for the current mirror list.)

Syntax

GUI:

ophcrack

CLI:

ophcrack-cli -d TABLE_DIR -t TABLE_NAME [options] -- hashfile

Command-Line Options

ophcrack-cli options:

GUI-specific workflow options (menu-driven, not flags):

Companion extraction utility:

samdump2 SYSTEM SAM > hashes.txt

Basic Usage

ophcrack-cli -d /usr/share/ophcrack/tables/xp_free_fast -t XP_free_fast -f hashes.txt

Expected output:

Ophcrack 3.8.0

Loading table xp_free_fast (1/1)...
Table loaded (100%).

Cracking hash for user 'jsmith'...
LM Hash : 299BD128C1101FD6AAD3B435B51404EE
NT Hash : 92937945B518814341DE3F726500D4FF

Progress: 100%   Found: SUMMER23

user: jsmith   LM: SUMMER23   NT: Summer23

1 of 1 hashes cracked (100%)

Practical Examples

Example 1 — Extracting hashes from a copied SAM/SYSTEM hive

samdump2 SYSTEM SAM > hashes.txt
cat hashes.txt

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jsmith:1001:299bd128c1101fd6aad3b435b51404ee:92937945b518814341de3f726500d4ff:::

Example 2 — CLI crack using the XP free rainbow tables

ophcrack-cli -d /usr/share/ophcrack/tables/xp_free_fast -t XP_free_fast -f hashes.txt -o cracked.txt

Progress: 100%   Found: SUMMER23
1 of 2 hashes cracked (50%)

cat cracked.txt

jsmith:SUMMER23:Summer23

Example 3 — GUI-based crack from a PWDUMP file

[GUI] File > Load > PWDUMP file > hashes.txt
[GUI] Tables > Enable "vista_free" > OK
[GUI] Click "Crack"

Status: Cracking...
Progress: 87%
Found 1/2 passwords

Example 4 — Limiting memory usage during a large table crack

ophcrack-cli -d /mnt/tables/vista_free -t Vista_free -m 2048 -f hashes.txt

Loading table Vista_free with 2048 MB RAM limit...
Table loaded (100%).
Progress: 100%

Example 5 — Cracking only a specific user’s hash

ophcrack-cli -d /usr/share/ophcrack/tables/xp_free_fast -t XP_free_fast -f hashes.txt -e jsmith

Cracking hash for user 'jsmith' only...
Found: SUMMER23

Example 6 — Using multiple rainbow table sets in one run

ophcrack-cli -d /mnt/tables -t "XP_free_fast,Vista_free" -f hashes.txt -o full_results.txt

Loading table XP_free_fast... done
Loading table Vista_free... done
2 of 2 hashes cracked (100%)

Example 7 — Verifying an Administrator account has no LM hash set (modern default)

grep Administrator hashes.txt

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Note: aad3b435b51404eeaad3b435b51404ee is the constant "empty LM hash" value —
this account has LM hashing disabled and Ophcrack's LM tables will not help;
an NTLM-capable table or a tool like Hashcat/John is required instead.

Example 8 — Exporting results after a GUI crack session

[GUI] File > Save > cracked_report.txt

Saved 3 cracked passwords to cracked_report.txt

Common Use Cases

• Recovering legacy Windows local account passwords from LM-hash-enabled systems (older Windows XP/2003 era, or systems with LM compatibility deliberately re-enabled)
• Quickly validating whether local Windows accounts on an in-scope machine use weak, rainbow-table-crackable passwords
• Physical/offline access engagements — booting a target machine from the Ophcrack LiveCD to extract and crack hashes without needing the OS credentials
• Educational demonstrations of why LM hashing is fundamentally broken and why it was deprecated
• Cross-checking results from a GPU-based Hashcat/John NTLM crack against a rainbow-table approach when LM hashes are present

Automation with Bash

#!/bin/bash
# ophcrack-extract-and-crack.sh — extract hashes from copied hive files and run CLI crack
SYSTEM_HIVE="SYSTEM"
SAM_HIVE="SAM"
TABLE_DIR="/usr/share/ophcrack/tables/xp_free_fast"
TABLE_NAME="XP_free_fast"

samdump2 "$SYSTEM_HIVE" "$SAM_HIVE" > hashes.txt
ophcrack-cli -d "$TABLE_DIR" -t "$TABLE_NAME" -f hashes.txt -o cracked_results.txt

echo "[*] Cracked results:"
cat cracked_results.txt

#!/bin/bash
# ophcrack-batch.sh — run against multiple extracted hash files (e.g., from several hosts)
TABLE_DIR="/usr/share/ophcrack/tables/xp_free_fast"
TABLE_NAME="XP_free_fast"

for hashfile in host_*_hashes.txt; do
  echo "[*] Cracking $hashfile"
  ophcrack-cli -d "$TABLE_DIR" -t "$TABLE_NAME" -f "$hashfile" -o "cracked_${hashfile}"
done

Tips and Best Practices

• Check for the constant empty-LM-hash value (aad3b435b51404eeaad3b435b51404ee) before spending time on a rainbow-table crack — it means LM hashing is disabled and Ophcrack’s classic strength (LM tables) will not apply; pivot to NTLM-capable tables or Hashcat/John instead.
• Larger, paid rainbow table sets from Objectif Sécurité dramatically increase success rate over the free tables, especially for NTLM; factor this into engagement planning and budget if Ophcrack is a core part of the toolkit.
• Rainbow tables trade disk space for crack time — keep enough free disk/RAM available, as full table sets can be tens of gigabytes and CLI/GUI loading can be memory-intensive (-m helps cap this).
• Use the dedicated Ophcrack LiveCD when you have physical access to a powered-off machine — it avoids needing to boot into Windows at all to pull the SAM/SYSTEM hives.
• For modern Windows targets (Vista and later, LM disabled by default, strong NTLM passwords), treat Ophcrack as a secondary/legacy tool and prefer Hashcat/John for primary NTLM cracking work.

Troubleshooting

References

• Official site: https://ophcrack.sourceforge.io/
• SourceForge project (including rainbow table downloads): https://sourceforge.net/projects/ophcrack/
• Kali Linux tool page: https://www.kali.org/tools/ophcrack/
• Objectif Sécurité (commercial rainbow tables): https://www.objectif-securite.ch/en/ophcrack