1

I am currently doing a penetratiion test, and have captured a bunch of NTLM hashes via NBSN spoofing.

An example (this is not taken from what I captured, and is random but the format is the same) would be:

[*] SMB Captured - 2014-12-11 11:20:00 -0500
NTLMv1 Response Captured from 1.1.1.1:62222 - 1.1.1.1 
USER:justauser DOMAIN:JUSTADOMAIN OS: LM:
LMHASH:Disabled 
NTHASH:1b62d8db74e0d7102334bc7dcc224d7daecd3e2041ad0921

I had thought that this NTHASH could be used with a pass the hash attack, however setting it as the parameter for the SMBPass option in metasploits psexec module fails.

Am I doing something wrong? It is my understanding that if a NTLMv1 hash is captured it does not need to be cracked.

closed as off-topic by schroeder, Steve, Xander, Jens Erat, Stephane Dec 12 '14 at 12:44

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – schroeder, Steve, Xander, Jens Erat, Stephane
If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.