I'm running a simple test of Metasploit's auxiliary/server/capture/smb.

It works, but both LMHASH & LM are empty

[*] SMB Captured - 2016-09-27 16:49:31 +0800
NTLMv2 Response Captured from -

I have been trying this on Windows 7, 2008 and 2003, none of them works.

Any ideas?


LM hashes over a network are disabled by default on post Windows XP systems.

You will have to use a group policy/local security policy to enable that behaviour again. Changing the defaults was done obviously to prevent weak hashes being sent over the network for authentication. Microsoft figured that by the time a corporation had Windows 7, the environment wouldn't have a Pre-XP machine, so there was no need for compatibility.

LM Hashes will also not be generated when:

  • User has a password that is too long for the LanMan hashing scheme
  • LM hash generation was disabled completely by group/local policy

I just tested this on a Win7, Win10, and XP machine.

I believe your issue is the firewall settings on the newer operating systems.

It worked perfect on the xp machine, but it was not successful on the Win7, or the Win10

I would suggest checking the firewall settings on your victim machines.


It's pretty standard practice to disable this on enterprise machines.

As an example you could check:

To disable transmission of LM hashes across the network on a single computer,
 complete these steps:
Open the registry editor 
Browse to HKLM\System\CurrentControlSet\control\LSA 
Find the key named “LMCompatibilityLevel” 
Change this value to “5” to completely disable the use of LM authentication.

(by way of someone elses walkthrough)

It's also possible the account didn't even generate an LM Hash (that's configurable as well.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.