1

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from the IP address. Could the hash be extracted from it?

I am running Linux

3
  • 1
    Notice that SMB sends by default the username and password by clear text... Jun 5, 2016 at 15:09
  • @BubbleHacker My incorrect password or the correct password
    – Suici Doga
    Jun 6, 2016 at 1:06
  • Which ever you send
    – Henry F
    Jun 14, 2017 at 1:27

2 Answers 2

2

Smb uses two main authentication schemes:

  • ntlm - a challenge response protocol sending a salted hash
  • kerberos - a centralized authentication protocol using a salted hash as the encryption mechanism.

In both cases you cant extract a plain nt hash from the traffic, but you can bruteforce it as the challenge is supplied.

0

To answer your direct question: Yes, the hash that you are observing can be extracted and possibly cracked (Based on the complexity of the password, the amount of power your putting into cracking it, etc.). The majority of the time, the hash will be either an NTLMv1 or v2, and you will see the occasional kerberos. There are a few tools out there, like HashIdentifier, that will help you in identifying the type of hash which you extracted.

Note: Passing-the-hash techniques may be unavailable for you as the newer NTLM hashes cannot be passed, and you will need to rely on cracking it rather than passing it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .