1

When a user logs on with domain credentials on a Windows 7 machine, I assume that some sort of handshake happens with the logon server/domain controller, where the ntlm hash sent by the user is compared to the hash on the domain controller.

If this is the case, is it possible to sniff the network traffic sent to domain controllers to intercept password hashes using arp spoofing/mtim attacks? Or are the hashes themselves encrypted in transit?

Improve this question
2
  • 1
    It is not encrypted when Kerberos is not used and Microsoft IT recommends Tomate up IPSec with the Domain Controllers for that reason.
    – eckes
    Feb 21, 2017 at 23:15
  • I'm not sure about the first assumption in all cases. I have a laptop and when it is off the network, I still use the domain credentials to login. There's a synchronization at some point when it is on the network but there has to be something stored locally.
    – JimmyJames
    Feb 22, 2017 at 18:32

1 Answer 1

Reset to default
1

Yes, in the case of interactive logon and any "windows" network based authentication, your hashes are protected in transit. Neither Kerberos nor NTLM sends a hash, instead the handshake uses various cryptography to prove the user knows the password without ever sending it. NTLMv1 uses VERY weak cryptography and is easily broken. NTLMv2 and Kerberos are both very strong for now. That said, if an attacker can capture the auth packets, they can use brute force to find the password. This is why it is vital to require long and complex passwords. https://markgamache.blogspot.com/2013/01/rehashing-pass-hash.html

Improve this answer

You must log in to answer this question.