I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from the IP address. Could the hash be extracted from it?

I am running Linux

  • 1
    Notice that SMB sends by default the username and password by clear text... – Bubble Hacker Jun 5 '16 at 15:09
  • @BubbleHacker My incorrect password or the correct password – Suici Doga Jun 6 '16 at 1:06
  • Which ever you send – Henry F Jun 14 '17 at 1:27

Smb uses two main authentication schemes:

  • ntlm - a challenge response protocol sending a salted hash
  • kerberos - a centralized authentication protocol using a salted hash as the encryption mechanism.

In both cases you cant extract a plain nt hash from the traffic, but you can bruteforce it as the challenge is supplied.


To answer your direct question: Yes, the hash that you are observing can be extracted and possibly cracked (Based on the complexity of the password, the amount of power your putting into cracking it, etc.). The majority of the time, the hash will be either an NTLMv1 or v2, and you will see the occasional kerberos. There are a few tools out there, like HashIdentifier, that will help you in identifying the type of hash which you extracted.

Note: Passing-the-hash techniques may be unavailable for you as the newer NTLM hashes cannot be passed, and you will need to rely on cracking it rather than passing it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.