Kerberos - NTLM Password Hashes - Questions!

Question

I have worked as a system administrator mainly on Widnows Server for some years now. Over the course of time I've always had a hard time trying to fully understand how Kerberos work. For about 3 weeks as of now I have been informing and studying ethical hacking, this involves Kerberoasting of course.

Now, one of the things I have noticed by reading articles, watching videos and all that, is that you can either get NT Hashes (pass-the-hash) or get Kerberos tickets for services depending on the scenario.

https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberos-authentication

This is one of the phases Kerberos has, as you can see the TGT is signed by the KDC using the NT Hash of the krbtgt account, the other portion for the user which contains session key, TGT expiration time and a nonce, is encrypted by the user NT Hash.

Then we have TGS-REP (I know I skipped steps), which uses the service account hashed password and session key is generated.

There's two keys in Kerberos, the user encryption key, and the session key, which are encrypted using for example RC4, DES or AES128 and AES256.

However, when the password of the user or service is encrypted, is not the actual password that's encrypted but the actual NT Hash of the password, which in theory are NTLM passwords. These are the same hashes compared when doing a cached logon against the local SAM, or even when access services over the network using IP addresses instead of hostname hence doing NTLM.

Now, according to the following article and others I've read about NTLM; NTLMv1 uses DES as a hashing algorithm and NTLMv2 uses MD5, which quite frankly are considered old on these days:

https://book.hacktricks.xyz/windows-hardening/ntlm

Modern operating systems use SHA-1 or even SHA-256 as a hashing algorithm, in fact, TLS sessions cipher suites (the modern ones) also use SHA for hashing the data packets.

My question at this point is...if NTLM (1 and 2) use old algorithms for password hashing...how are newer operating systems or even systems with DES and MD5 disabled either through registry (it can be done as well as restrcting cipher suites for TLS) or per application able to decrypt NTLM hashes? This would apply for local logons as well as file shares over the network by IP (just to name one). I understand that Kerberos would not do it as it never actually hashes the password or unhash it.

The Kerberos RFC here talks about PBKDF2 and Wikipedia says it's a way to generate keys:

https://datatracker.ietf.org/doc/html/rfc3962#section-4

https://en.wikipedia.org/wiki/PBKDF2

I am trying to get my head around this as basically owning NTLM hashes gives you all the power over a domain if you can get a ticket or login with a domain admin and at this point I even think the extra security in Kerberos is not being benefitial.

Please shed some light over here! I'd appreciate it so much.

Answer 1

TLDR; The SAM database (for local logon) and the Domain Controller (when accessing network resource) are in charge of "decrypting" the NT Hash. NTLMv1/v2 and Kerberos are just the vehicle the NT Hash rides on over the network to get to the Domain Controller.

NTLMv1, NTLMv2, and Kerberos DO NOT even attempt to determine if the NT hash is correct. This is a job for the SAM database or for the Domain Controllers NTDS database. When you do a local logon (sitting down at the computer screen) your password will be converted to a NT hash and that will be passed to the SAM database which will have a record of you if you have locally logged in before. The NT hash from your login and the NT hash in the SAM database will be compared.

When accessing a network resource, you will pass your NT hash VIA NTLMv1/v2 or Kerberos, or in other words, NTLMv1/v2 and Kerberos will safely carry and protect your NT hash over the network and will travel to your server and that server will pass that NT hash over to the Domain controller. The Domain Controller will then check to see if the NT hash you provided to the server matches what it has in its NTDS database.

---

More Detail

Oof my friend this topic is hard! okay lets just begin with a standard. NT hash, often referred to as a NTLM hash, but I will refer to it as a NT Hash because it avoids confusion. What confusion? Well, the NTLM Hashing Algorithm produces the NT Hash/NTLM Hash and the NTLM Authentication Protocol also produces a hash but this one is referred to as the Net-NTLMv1/v2 Hash. Its too similar and people will often be too generic its hard to discern a reference to the Hashing Algorithm Hash or the Authentication Protocol Hash.

Understanding How The Hash Fits In

https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4

So lets start with the NT Hash(aka NTLM hash) from now on referred to as NT Hash. NT Hash is the end result of the New Technology Lan Manager Hashing Algorithm that was a replacement for the Lan Manager Hashing Algorithm. Both of these hashing algorithms will take a clear text password and convert them to cipher text. Example from https://www.jscape.com/blog/understanding-hashing :

peter: password1234

james: mac@pRoS

sharon: shadowfax

Instead, it would likely look like this:

peter: uclQZA4bN0DpisuT5mnGV2b2Zw3RYJupH/QQUrpIxvM=

james: xw5UIGACzaNtYyZZjkaRY4a6uoVKhriy7NGLlW+COeM=

sharon: VgGAZRvmCKHoedevnDP2fUHMfuUNTcTL2XqFJGK7/qg=

OKAY. So. The NTLM Hashing Algorithm will produce a NT Hash. It is not safe to send these over the network because the hash is directly correlated with the clear text password. So you need a authentication protocol that will protect the original NT Hash and these is where the NTLM Authentication Protocol and Kerberos come in.

Understanding How the Authentication Fits In

NTLM Authentication Protocol had two versions...Version 1 and Version 2. both will create their respective hash, known as Net-NTLMv1/2 Hash. Before the NTLM Authentication Protocol can create a Net-NTLM hash it needs perform a bunch of operations on a copy of a NT hash of a user. This is a NT hash

B4B9B02E6F09A9BD760F388B67351E2B

And this is what the NTLM Authentication Protocol would do to the NT hash (FYI This is what a Net-NTLMv2 Hash looks like)

admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030

The NT hash can be cracked to reveal the plaintext password. The Net-NTLMv2 hash can also be cracked but its gonna take more time compared to the NT hash. Side note the Net-NTLMv2 hash is what you will be working with in NTLM relay attacks.

As mentioned above, the Authentication Protocol that is chosen is in charge of safely transmitting the NT Hash from one endpoint across the network to another endpoint.

Final comments

Modern operating systems use SHA-1 or even SHA-256 as a hashing algorithm, in fact, TLS sessions cipher suites (the modern ones) also use SHA for hashing the data packets.

Yes, modern operating system are capable of using these different hashing algorithms, but Windows does not use those algorithms to store passwords

https://learn.microsoft.com/en-us/windows-server/security/kerberos/passwords-technical-overview#passwords-stored-in-active-directory

So you will have all these protocols using all these really strong hashing algorithms and encrypting their respective protocol data packets with, but inside that encrypted protocol packet will be a NT Hash

There's two keys in Kerberos, the user encryption key, and the session key, which are encrypted using for example RC4, DES or AES128 and AES256.

It actually has three keys and is literally the answer to your ultimate question. This is the source of most of the encryption/decryption. The NT hashes of all three accounts( the user, the service, the Domain Controller "krbtgt") If you wanna have the "AHA" moment then go check out a video that Attl4s made on it https://www.youtube.com/watch?v=4LDpb1R3Ghg

And here is a article that breaks down the different exchanges between the client and the Domain Controller https://syfuhs.net/a-bit-about-kerberos

Answer 2

"...how are newer operating systems or even systems with DES and MD5 disabled either through registry (it can be done as well as restricting cipher suites for TLS) or per application able to decrypt NTLM hashes?"

The system doesn't decrypt NTLM hashes, but Kerberos uses the NTLM hash as the key to encrypt the messages transferring between client and server (or DC).