NTLM
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
In environments where Windows XP and Server 2003 are in operation, LM (Lan Manager) hashes are utilized, although it's widely recognized that these can be easily compromised. A particular LM hash, AAD3B435B51404EEAAD3B435B51404EE, indicates a scenario where LM is not employed, representing the hash for an empty string.
By default, the Kerberos authentication protocol is the primary method used. NTLM (NT LAN Manager) steps in under specific circumstances: absence of Active Directory, non-existence of the domain, malfunctioning of Kerberos due to improper configuration, or when connections are attempted using an IP address rather than a valid hostname.
The presence of the "NTLMSSP" header in network packets signals an NTLM authentication process.
Support for the authentication protocols - LM, NTLMv1, and NTLMv2 - is facilitated by a specific DLL located at %windir%\Windows\System32\msv1\_0.dll.
Key Points:
LM hashes are vulnerable and an empty LM hash (AAD3B435B51404EEAAD3B435B51404EE) signifies its non-use.
Kerberos is the default authentication method, with NTLM used only under certain conditions.
NTLM authentication packets are identifiable by the "NTLMSSP" header.
LM, NTLMv1, and NTLMv2 protocols are supported by the system file msv1\_0.dll.
You can check and configure which protocol will be used:
Execute secpol.msc -> Local policies -> Security Options -> Network Security: LAN Manager authentication level. There are 6 levels (from 0 to 5).
This will set the level 5:
Possible values:
The user introduces his credentials
The client machine sends an authentication request sending the domain name and the username
The server sends the challenge
The client encrypts the challenge using the hash of the password as key and sends it as response
The server sends to the Domain controller the domain name, the username, the challenge and the response. If there isn't an Active Directory configured or the domain name is the name of the server, the credentials are checked locally.
The domain controller checks if everything is correct and sends the information to the server
The server and the Domain Controller are able to create a Secure Channel via Netlogon server as the Domain Controller know the password of the server (it is inside the NTDS.DIT db).
The authentication is as the one mentioned before but the server knows the hash of the user that tries to authenticate inside the SAM file. So, instead of asking the Domain Controller, the server will check itself if the user can authenticate.
The challenge length is 8 bytes and the response is 24 bytes long.
The hash NT (16bytes) is divided in 3 parts of 7bytes each (7B + 7B + (2B+0x00*5)): the last part is filled with zeros. Then, the challenge is ciphered separately with each part and the resulting ciphered bytes are joined. Total: 8B + 8B + 8B = 24Bytes.
Problems:
Lack of randomness
The 3 parts can be attacked separately to find the NT hash
DES is crackable
The 3º key is composed always by 5 zeros.
Given the same challenge the response will be same. So, you can give as a challenge to the victim the string "1122334455667788" and attack the response used precomputed rainbow tables.
Nowadays is becoming less common to find environments with Unconstrained Delegation configured, but this doesn't mean you can't abuse a Print Spooler service configured.
You could abuse some credentials/sessions you already have on the AD to ask the printer to authenticate against some host under your control. Then, using metasploit auxiliary/server/capture/smb or responder you can set the authentication challenge to 1122334455667788, capture the authentication attempt, and if it was done using NTLMv1 you will be able to crack it.
If you are using responder you could try to **use the flag --lm ** to try to downgrade the authentication.
Note that for this technique the authentication must be performed using NTLMv1 (NTLMv2 is not valid).
Remember that the printer will use the computer account during the authentication, and computer accounts use long and random passwords that you probably won't be able to crack using common dictionaries. But the NTLMv1 authentication uses DES (more info here), so using some services specially dedicated to cracking DES you will be able to crack it (you could use https://crack.sh/ or https://ntlmv1.com/ for example).
NTLMv1 can also be broken with the NTLMv1 Multi Tool https://github.com/evilmog/ntlmv1-multi which formats NTLMv1 messages im a method that can be broken with hashcat.
The command
would output the below:
Create a file with the contents of:
Run hashcat (distributed is best through a tool such as hashtopolis) as this will take several days otherwise.
In this case we know the password to this is password so we are going to cheat for demo purposes:
We now need to use the hashcat-utilities to convert the cracked des keys into parts of the NTLM hash:
Ginally the last part:
Combine them together:
The challenge length is 8 bytes and 2 responses are sent: One is 24 bytes long and the length of the other is variable.
The first response is created by ciphering using HMAC_MD5 the string composed by the client and the domain and using as key the hash MD4 of the NT hash. Then, the result will by used as key to cipher using HMAC_MD5 the challenge. To this, a client challenge of 8 bytes will be added. Total: 24 B.
The second response is created using several values (a new client challenge, a timestamp to avoid replay attacks...)
If you have a pcap that has captured a successful authentication process, you can follow this guide to get the domain, username , challenge and response and try to creak the password: https://research.801labs.org/cracking-an-ntlmv2-hash/
Once you have the hash of the victim, you can use it to impersonate it. You need to use a tool that will perform the NTLM authentication using that hash, or you could create a new sessionlogon and inject that hash inside the LSASS, so when any NTLM authentication is performed, that hash will be used. The last option is what mimikatz does.
Please, remember that you can perform Pass-the-Hash attacks also using Computer accounts.
Needs to be run as administrator
This will launch a process that will belongs to the users that have launch mimikatz but internally in LSASS the saved credentials are the ones inside the mimikatz parameters. Then, you can access to network resources as if you where that user (similar to the runas /netonly trick but you don't need to know the plain-text password).
You can obtain code execution in Windows machines using Pass-the-Hash from Linux. Access here to learn how to do it.
You can download impacket binaries for Windows here.
psexec_windows.exe C:\AD\MyTools\psexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.my.domain.local
wmiexec.exe wmiexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local
atexec.exe (In this case you need to specify a command, cmd.exe and powershell.exe are not valid to obtain an interactive shell)C:\AD\MyTools\atexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local 'whoami'
There are several more Impacket binaries...
You can get the powershell scripts from here: https://github.com/Kevin-Robertson/Invoke-TheHash
This function is a mix of all the others. You can pass several hosts, exclude someones and select the option you want to use (SMBExec, WMIExec, SMBClient, SMBEnum). If you select any of SMBExec and WMIExec but you don't give any Command parameter it will just check if you have enough permissions.
Needs to be run as administrator
This tool will do the same thing as mimikatz (modify LSASS memory).
For more information about how to obtain credentials from a Windows host you should read this page.
Read more detailed guide on how to perform those attacks here:
Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay AttacksYou can use https://github.com/mlgualtieri/NTLMRawUnHide
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
