NTLMv1 or NTLMv2 is a Windows Challenge-Response authentication protocol used in authenticating users in interactive and non-interactive logons. Interactive logons and non-interactive logons are explained here
NTLMv1 and NTLMv2 authentication protocols have vulnerabilities like pass-the-hash, reflection and relay attacks but are immune to Rainbow Tables attacks.
NT Hash is referred to as NT One-Way Function (NTOWF) in MSDN Documentation on NTLMv1 and NTLMv2 and uses the MD4 or MD5 hashing algorithm to obtain the hash from a user’s password. NTOWF uses MD4 or MD5 hashing algorithms to compute the hash from a user’s password. The NT Hashes of all users in a Windows domain are stored in the ntds.dit file on the Domain Controllers. While the NT Hash of user’s password can also be retrieved from the Security Account Manager (SAM) and SECURITY Registry hives of Windows systems they interactively logon.
NTLM is often used interchangeably to refer the NTLM Challenge-Response Protocol and the NTOWF, which is the root cause of this confusion.
The lack of salting in storing users password NTOWF on Windows systems or Domain Controllers makes it vulnerable to Rainbow Tables attacks.
Here is how the string ‘hashcat’ looks like as NTOWF and when used in NTLMv1 and NTLMv2. I have borrowed this from hashcat’s example hashes webpage.
b4b9b02e6f09a9bd760f388b67351e2b => This remains static and will be stored in identical format in the SAM or Domain Controller until the password is changed.
NTLMv2 admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030 => This authentication response will change even if the password is ‘hashcat’ as the challenge used to compute this response changes everytime the Challenge-Response protocol is negotiated.
NTLMv1 u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c => This authentication response will change even if the password is ‘hashcat’ as the challenges used to compute this response changes everytime the Challenge-Response protocol is negotiated.
Wikipedia has a good writeup on how NTLMv1 and NTLMv2 authenticate users by using their passwords (aka NTOWF) in “NT Lan Manager”.
In case you are curious why NTLMv1 and NTLMv2, the prior authenticates client to server and not vice-a-versa while the later authenticates both the client and server to each other.