Hashcat GPU Cracking: Complete Setup & Usage Guide

In the 2024 RockYou2024 leak, researchers cracked over 60% of exposed NTLM hashes within 90 minutes using commodity GPU hardware. The tool doing the heavy lifting in most of those sessions was Hashcat. If you’re running penetration tests or auditing your organization’s password policy, GPU-accelerated cracking is a skill you need — and Hashcat is where you start.

Installing Hashcat and Verifying GPU Access

Hashcat works on Linux, Windows, and macOS. Most practitioners run it on Linux with an NVIDIA GPU and CUDA drivers. Install it fast with your package manager or grab the latest binary from hashcat.net.

# Install on Debian/Ubuntu
sudo apt update && sudo apt install hashcat

# Verify GPU detection
hashcat -I

The -I flag lists every OpenCL and CUDA device Hashcat can see. A healthy output looks like this:

OpenCL Info:
============

OpenCL Platform #1
  Name...: NVIDIA CUDA
  Devices #1
    Name...: NVIDIA GeForce RTX 4080
    Processors: 76
    Clock: 2505 MHz
    Memory.Total: 16376 MB

If you see your GPU listed with memory above 4 GB, you’re ready to crack. If the device list is empty, your CUDA or OpenCL drivers aren’t installed correctly — fix that before anything else. On a headless server, install nvidia-driver and reboot. No GPU at all? Hashcat runs on CPU too, just expect 100x slower speeds.

Cracking NTLM Hashes with a Dictionary Attack

NTLM is the hash format used by Windows Active Directory. During a penetration test on corp-dc01.internal (192.0.2.10), you’ve used Impacket’s secretsdump to pull the NTDS.dit and have a file of hashes for users like jparker and swhite. Dictionary attack is your first move — it hits weak and reused passwords fast.

# hashes.txt contains NTLM hashes from secretsdump
# Format: username:RID:LMhash:NThash:::
# We strip just the NT hash for Hashcat

cat hashes.txt
jparker:1104:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
swhite:1105:aad3b435b51404eeaad3b435b51404ee:e10adc3949ba59abbe56e057f20f883e:::

# Extract NT hashes only
cut -d: -f4 hashes.txt > nthashes.txt

# Run dictionary attack — mode 1000 is NTLM
hashcat -m 1000 -a 0 nthashes.txt /usr/share/wordlists/rockyou.txt --status --status-timer=10

Breaking this command down: -m 1000 sets the hash type to NTLM. -a 0 is dictionary mode. The --status-timer=10 prints a progress update every 10 seconds so you’re not staring at a blank screen. On an RTX 4080, expect 60–80 billion NTLM hashes per second. RockYou.txt (14 million entries) completes in under two seconds at that speed.

Successful cracks appear at the end of the run and get saved automatically to hashcat.potfile:

e10adc3949ba59abbe56e057f20f883e:123456
8846f7eaee8fb117ad06bdd830b7586c:Password1

swhite’s password is 123456. jparker uses Password1. Both would pass most basic complexity policies — uppercase, number, eight characters. That’s why you’re here. Take those plaintext passwords and attempt lateral movement or escalation immediately. Check for password reuse across other accounts before the client rotates credentials.

Pushing Further: Rules and Hybrid Attacks

When a straight dictionary attack misses hashes, you escalate to rule-based attacks. Rules mutate wordlist entries — appending numbers, substituting letters, capitalizing — without you writing every variation by hand. Hashcat ships with the powerful best64.rule ruleset out of the box.

# Rule-based attack against remaining uncracked hashes
hashcat -m 1000 -a 0 nthashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule \
  -o cracked.txt --outfmt 2

The -r flag applies the ruleset. -o cracked.txt writes plaintext results to a file. --outfmt 2 outputs in hash:plain format for easy parsing. best64 generates 64 mutations per word, turning 14 million RockYou entries into nearly 900 million candidates — still finishing in seconds on modern GPU hardware.

For passwords that follow a known pattern (company name plus year), try a hybrid attack combining a wordlist with a mask:

# Hybrid attack: wordlist + 4-digit year suffix
hashcat -m 1000 -a 6 nthashes.txt wordlist.txt "?d?d?d?d"

-a 6 is hybrid mode. ?d means any digit. This cracks passwords like Acorp2023 or Winter2024 that dictionary and rule attacks miss. In Active Directory environments, seasonal passwords are shockingly common — your AD password policy audit will prove it.

What To Do Now

Pull your own Active Directory password hashes in a lab environment using Impacket’s secretsdump.py against a test domain controller, then run Hashcat with RockYou and best64.rule against the results. Count what percentage crack in under five minutes. That number — whatever it is — is the data point you bring to your next security review to justify enforcing longer passphrases and blocking common passwords at the directory level.