Since tools like Cain and Abel can sniff clear text passwords off most HTML pages, is it possible to configure the sniffing of clear text windows smb logons? I tried searching it up but the best thing that came up was Responder's NTLMv2 capture however I read that most windows 7 systems still use ntlm, so is there any way to configure clear text or ntlm sniffing of smb windows logons?

  • 2
    – paj28
    Sep 7, 2016 at 19:12
  • What type of attack are you talking about? what do you have access to? attacking from the user's device, server or man in the middle? Oct 11, 2016 at 10:32

1 Answer 1


The NTLM challenge/response process does not transmit the passwords. If you want to get pedantic, neither the client nor the server has access to the passwords either.

Each has the NT hash of the user in question, which is used as the pre-shared key. Here's what happens when the client requests an SMB resource from the server:

  1. The server issues a challenge.
  2. Client encrypts the challenge using the user's NT hash as the key.
  3. Client sends the encrypted challenge to the server.
  4. Server encrypts its challenge with its copy of the user's hash.
  5. Server compares the two encrypted challenges. If they match, access is granted.

The best you're going to get if you're sniffing that traffic, or poisoning with Responder, is the NetNTLMv2 hash, which is the encrypted challenge. You can then attempt to crack this offline, but as paj28 said, the only way you're going to get cleartext is using a tool like Mimikatz, which can read them from lsass.exe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy