I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios:

1- I set up a web server on my machine and social-engineer the users to visit it.

2- I send an email with an embedded <img src="my.ip.address/x.gif"/> so that Outlook sends the NTLM credentials automatically.

3- I use XSS on a local website of theirs to get the NTLM credentials.

4- UNC path to my IP address in a Word file.

I would like to get help and opinions in the following matters:

  • Do you know of any tool that helps automate some parts here?
  • Will linking to users by IP address actually force them to use their NTLM credentials, not Kerberos?
  • Can I pull this attack on non-IE?
  • Does it have to be a Trusted Zone in IE? Will my IP address (local in their network range, not external) be considered a Trusted Zone/part of the domain in IE?
  • How can I get it in XSS? What kind of XSS code can help here?
  • Will Outlook Word document preview execute my UNC trick correctly or do they have to download and run it?

Thank you very much.

  • Tool of choice: Metasploit (UNC-Path into Docx , Metasploit generic NTLM relay)
  • Kerberos: Is not a problem, since it have to be implemented on your(!) server otherwise the victim will send you NTLM / NTLMv2 (maybe you are able to downgrade to v1)
  • IE Trusted Zone: Normally the local subnet have an own security zone, which is normally pretty low
  • Outlook preview (see UNC-Path into Docx)

Nice attack setup btw ;-)

| improve this answer | |
  • Thank you ;) What about XSS? Can you please elaborate on the ability to downgrade users to NTLMv1 (Or even LM?!) – Orca Apr 17 '13 at 9:25
  • If someone looks at your mail, they will get a preview via SMB, there is no need to exploit via embedded picture... Basically your server controls the authentification type (NTLM / NTLMv2) but in some systems downgrade is not allowed. Have a look at a few tools: code.google.com/p/squirtle oxid.it/cain.html they will do all the work (with cain even cracking ;-) ) – Dr.Ü Apr 17 '13 at 9:47
  • But... Since you are sitting in their local net, why not simply MITM - there is no need to spread mails ;-) It's quite enough to use some MITM tools and wait for the domain admin's NTLM... – Dr.Ü Apr 17 '13 at 16:27
  • They complained because of the performance degradation! And they use encryption, too. – Orca Apr 17 '13 at 16:36
  • Ok... seems legit ;-) – Dr.Ü Apr 17 '13 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.