Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [ntlm]

NT LAN Manager (NTLM) is a series of protocols developed by Microsoft.

2
votes
0answers
43 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
0
votes
0answers
17 views

NTLM retrieve password hash using KPA attack and responder net-NTLMv2

I've got few questions associated with NTLM protocol details. From MSDN (https://docs.microsoft.com/en-us/windows/desktop/secauthn/microsoft-ntlm): (Interactive authentication only) A user ...
1
vote
0answers
38 views

Is it secure to start a NTLM handshake not knowing if the server supports it?

I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests: import requests from requests_ntlm import HttpNtlmAuth requests.get("http://...
0
votes
1answer
108 views

Does NTLM authentication via HTTP not need a user name?

Because of a vulnerability that has been found in Exchange Server I was trying to run that attack on our local system to see if the workaround can successfully prevent it. I found a description of ...
0
votes
1answer
130 views

How to intercept ntlm authentication based application?

There is an internal application which authenticates based on windows credentials (NTLM Authentication). It is not intercepting while in proxy with Burp Suite and is stuck in login pop-up even after ...
1
vote
0answers
138 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
2
votes
1answer
164 views

Obtain NetNTLM/NTLM hash or login

In one CTF, I encountered a task that is solved by getting NetNTLM \ NTLM or just getting username. Tell me, please, is there any protocol that automatically sends NetNTLM / NTLM or username, when ...
2
votes
1answer
415 views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
2
votes
1answer
1k views

How is it that tools like Hashcat, JTR able to bruteforce an NTLMv2 hashes?

With regards to the following question about the feasibility of (brute|dictionary|rainbowtable)-forcing an NTLMv2 hash: How feasible is it for an attacker to brute-force an NTLMv2 response captured ...
3
votes
1answer
704 views

MsChapV2 authentication and Evil Twin attack

I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can ...
0
votes
1answer
59 views

Does Windows Authentication Use Secured Connection

I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
2
votes
1answer
315 views

NTLMv2 Hash harvesting remotely

I'm experimenting with ways to harvest NTLMv2 hashes remotely. Responder.py is perhaps the most widely used mechanism (these days) to perform the task, but I'm unsure if it's even possible to utilize ...
0
votes
1answer
4k views

Cant crack Responder hashes with John or Hashcat

I ran Responder in a test network and obtained hashes from a Windows machine. The logs for the machine show something like this (some bytes changed for security reasons) and are stored in a file ...
0
votes
1answer
2k views

John the Ripper Character Lists

How is it possible to use or prioritize umlauted characters - ä ö ü ß Ä Ö Ü - whilst brute forcing. I'm not using any wordlist, only dozens of CPU threads via the following command : ./john --fork=...
3
votes
2answers
528 views

How feasible is it for an attacker to brute-force an NTLMv2 response captured off the network?

According to the Wikipedia article on NTLM here: https://en.wikipedia.org/wiki/NT_LAN_Manager ..under the NTLMv2 description it mentions that NTLMv2 sends two responses to an 8-byte server ...
3
votes
2answers
3k views

Should I use rainbow tables or bruteforce (NTLM)?

As part of security testing, I will receive around 150 to 200 Active Directory password hashes from Windows Server 2012 R2 (using NTLM?). I have found NTLM rainbow tables (1,5 TB total), that covers ...
1
vote
1answer
139 views

Changing Structure of SAM database to disable LM usage

SAM database normally holds LM and NTLM hashes of local computer. Recently we applied configurations for disabling NTLMv1 usage in enterprise network . After that we mitigated LM hash usage on SMB ...
5
votes
1answer
18k views

Understanding Windows local password hashes (NTLM)

I have recently dumped some hashes from my local machine because I'm trying to understand the process in which Windows 7 hashes it's passwords. I have discovered my local password hash that looks (...
18
votes
2answers
20k views

How are Windows 10 hashes stored if the account is setup using a Microsoft account?

I was testing the integrity of my passwords and noticed that after I dumped the hashes, there was only one account where the NTLM hash was not a "default hash." I also know that that account happens ...
1
vote
1answer
64 views

Is it possible to export user account certificates remotely with NTLM hash authentication?

The EFS encryption uses user certificate, generated with his username and password, to encrypt the files so that only that user can access it. My question is this: Can you export user certificates ...
3
votes
3answers
3k views

NTLMv2 Reflection Attack

I am trying to figure out if NTLMv2 is vulnerable to a reflection attack. I cannot find a citation that clearly states NTLMv2 as being vulnerable. NTLMv1 is horribly insecure so there really is not ...
1
vote
1answer
774 views

Are Windows Hashes Encrypted in Transit?

When a user logs on with domain credentials on a Windows 7 machine, I assume that some sort of handshake happens with the logon server/domain controller, where the ntlm hash sent by the user is ...
1
vote
3answers
409 views

Why am I unable to capture LM & LMHASH?

I'm running a simple test of Metasploit's auxiliary/server/capture/smb. It works, but both LMHASH & LM are empty [*] SMB Captured - 2016-09-27 16:49:31 +0800 NTLMv2 Response Captured from 172.16....
0
votes
1answer
96 views

NTML2 Session Response and Browsers

I've been looking at the NTML2 Session Response which is apparently supported transparently by commonly used browsers. NOTE: This is not to be confused with full NTLMv2 authentication. This in-depth ...
0
votes
1answer
30 views

Client app auto-updating passwords, no SSO [closed]

My customer has an ActiveDirectory server and a work server, both without SSO. Employees use their ActiveDirectory account to connect to the work server. They change passwords every month. My app ...
1
vote
0answers
301 views

Same value of WSS_KeepSessionAuthenticated cookie for different users after login

There is an application that uses NTLM authentication. After you enter your credentials, you get three cookies. I logged in with three different browsers(IE, chrome and mozilla) and as three different ...
3
votes
1answer
426 views

Possible to connect to VNC server only with a NTLM Hash?

I'm using a training lab to learn computing security. And I retrieved the hash of the admin in this form: admin:1001:NO PASSWORD*********************:D4BF5A8658AFXXXXXXXX5B8DBB60859746::: So, I just ...
2
votes
3answers
4k views

Are rainbow tables a viable tool for cracking NTLMv2 hashes?

Background I am unclear about the difference between NTLM hashes and the NTLM protocol, regardless of version. My tentative understanding is that there is such a thing as an "NTLMv2 hash", and that ...
4
votes
1answer
30k views

Understanding NTLM Authentication Step by Step

I was reading this link on ASP.Net Authentication and Authorization and these 5 steps were there explaining NTLM authentication. Client sends the username and password to the server. Server ...
3
votes
1answer
5k views

How to check whether NTLM v2 or v1 is used for authentication?

Which tool should I use to check which NTLM authentication is used? Consider the fact that I am a user of the web application and not the owner. Are there any security concerns if a site uses NTLM ...
4
votes
2answers
772 views

Help converting string to NTLM

I'm trying to covert a string into a NTLM hash. From what I understand you just have to covert the characters in the string to unicode, format it to little endian and then hash it with the MD4 ...
4
votes
1answer
1k views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
2
votes
1answer
586 views

How to “Pass the hash” when LM hash is disabled?

I ran the NTLM_stealer metasploit module and ended up with the following results: LMHASH:Disabled NTHASH:008940f335e9b2ddc182bb5b960a0c5bad0b125cbee3cf84 I was wondering if there is way to ...
2
votes
1answer
241 views

Security behind “Windows Security” Feature

Within the Windows Security authentication mechanism active, there are cases the user-login popup comes up. Are this username and password sent encrypted or they are sent as plain-text as the auth-...
1
vote
1answer
1k views

Can a corporate proxy downgrade an SSL handshake?

At work, I'm behind an NTLM Proxy. When the SSL Poodle flaw came out, I hardened the configuration of my private server, and found out that even if the client and server shared common ciphers, some ...
1
vote
1answer
799 views

Identifying hash format caputred via Metasploit

When I use the nbns_repsonde module in metasploit, and set it to write captured responses to a file in the john format, I get a file with lines such as this: username::DOMAIN:...
1
vote
0answers
617 views

Passing the hash with metasploit and psexec not working - why? [closed]

I am currently doing a penetratiion test, and have captured a bunch of NTLM hashes via NBSN spoofing. An example (this is not taken from what I captured, and is random but the format is the same) ...
11
votes
1answer
9k views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...