With regards to the following question about the feasibility of (brute|dictionary|rainbowtable)-forcing an NTLMv2 hash: How feasible is it for an attacker to brute-force an NTLMv2 response captured off the network?
..I'm trying to understand how is it that tools like Hashcat and John-the-ripper are able to bruteforce them using wordlists.
How is that hashchat and JTRare able to do this to an NTLM hash without knowing the Server Challenge (SC) and Client Challenge (CC, CC*) bits in the formula?..
All those 3 values are supposed to make the hash ‘Random’.
Or is it that those tools brute force the 8-byte SC and and CC, CC* values as well?
Articles listing how the attack is done can be found everywhere so I'm trying to understand the actual mechanism behind the attack. e.g.: https://www.4armed.com/blog/llmnr-nbtns-poisoning-using-responder/