What hash type is being cracked in the command below? hashcat -m 1800 -a 0 customer.ntds wordlist.txt --potfile-path ./hashcat.potfile

SHA-1 is represented by '-m 100' in hashcat; '-m 1800' does not correspond to SHA-1 in any context.

LANMAN hashes use '-m 3000' in hashcat, not '-m 1800', and are a legacy Windows authentication scheme.

The '-m 1800' flag in hashcat corresponds to sha512crypt ($6$), which is the SHA-512-derived password hashing algorithm used by default in modern Linux and Unix systems. The '-a 0' flag specifies a dictionary attack, meaning hashcat hashes each word in wordlist.txt using sha512crypt and compares it against the entries in customer.ntds.

NT hashes (NTLM) use '-m 1000' in hashcat, not '-m 1800', and are the Windows password hash format stored in NTDS.