For example, do you know if this is NTLM or NTLMv2?

27EBE7918C717D8A8F1AB7B8643FE9E1

I'm 100% it's not LM.

I'm not trying to crack the hash, I'm trying to pass it. So far no pass-the-hash tool was able to pass it, which leads me to believe that it is NTLMv2. But I was looking for something more solid.

thx

I actually did a hashdump on a Windows 2003 system. The system has different systems connect to it (XP, Vista, 7), I can see some records with LM and NTLM from all XP machines and few from Vista machines. Windows 7 users password hashes is showing as NO-PASSWORD********:PASSWORD

I think PASSWORD here is in NTLMv2 form.

Does anyone know of a tool that can pass NTLMv2 hashes available?