Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [ntlm]

NT LAN Manager (NTLM) is a series of protocols developed by Microsoft.

Filter by
Sorted by
Tagged with
1 vote
1 answer
87 views

Can NTLM pass-through authentication be done without NetLogon?

In any "recent" documentation regarding NTLM (Microsoft) I see it stated that the mechanism of pass-through authentication is done over a NetLogon channel, which should be secure. This ...
superstav's user avatar
0 votes
0 answers
96 views

Impossible NTLMv2 hash format with Responder lm option

While doing an internal assessment, I stumbled upon a very weird looking NTLMv2 hash (I will not use the "Net-NTLM" terminology but I'm talking about the NTLM protocol ) while using ...
Joy's user avatar
  • 1
0 votes
1 answer
126 views

It is possible to receive ntlm response with ipv6. What about ipv4?

I performed ntlm relay attack with mitm6 and ntlmrelayx. I used mitm6 for dns spoofing. When the victim sent a query containing where the DHCP is located, I identified myself as the DHCP server. Then ...
Firat's user avatar
  • 13
0 votes
0 answers
136 views

Using rainbow tables to obtain the first 7 characters of a windows password(LM/NTLMv1)

I am trying to understand how an attacker is able to use the halflm challenge rainbow table to obtain the first 7 characters of a windows password that was used to authenticate a user using LM/NTLMv1. ...
Teererai Marange's user avatar
3 votes
2 answers
1k views

Kerberos - NTLM Password Hashes - Questions!

I have worked as a system administrator mainly on Widnows Server for some years now. Over the course of time I've always had a hard time trying to fully understand how Kerberos work. For about 3 weeks ...
Matías Huartamendía's user avatar
0 votes
1 answer
582 views

How to generate actually valid NTLM hash for chntpw (for SAM hive file injection)

I am currently working on a solution to at least try to implement a working/modern "change password" option to chntpw. First of all: Windows uses this format in its hive file: root@rescue /...
HeartOfGermany's user avatar
3 votes
0 answers
293 views

Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?

When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
purple-explorer's user avatar
0 votes
1 answer
3k views

pwdump8-8.2 correct hash for Microsoft Account Win10

I am having a real issue cracking one NT hash i've pulled from my system for a Microsoft Account. I used - PwDump8.2 I have an admin account unlocked on the system and can access most files. I know ...
Patho's user avatar
  • 5
0 votes
1 answer
657 views

Are there other types of NT Password (NTLM Hash) besides raw MD4?

According to the freeradius document https://freeradius.org/radiusd/man/rlm_pap.txt I can use NT-Password as the type of storing user's password. However, I have only found the type of generating raw ...
Steven Yang's user avatar
1 vote
1 answer
1k views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: NTLM auth starts with a negotiation packet sent by the client. In this ...
Eran Nahshon's user avatar
1 vote
1 answer
373 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif. Causing forced authentication which passes the NTLM hash....
Alexander Arnold's user avatar
1 vote
1 answer
658 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
Eran Nahshon's user avatar
1 vote
0 answers
536 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
nameless's user avatar
  • 129
1 vote
0 answers
140 views

Is the ability to export HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SYSTEM as .reg files a security concern?

I am concerned that if it is possible to copy these as .reg files (without privs) and then (on another machine) reverse the .hiv files from them... this would probably be bad, which makes me think it'...
PlasticCasio's user avatar
0 votes
0 answers
390 views

Running Responder outputs many hashes per user, how is this possible?

I am running Responder on Kali Linux within a client network using the following command sudo responder -I eth0 -w -r -d which is capturing many hashes in the environment. Responder is a LLMNR, NBT-...
trallgorm's user avatar
  • 885
1 vote
1 answer
4k views

Is it possible make a Pass-The-Hash attack with Responder?

The tool Responder written in Python permits to listen on a specific network card requests and automatically poisoning victims the steal hash NTLMv1 and hash NTLMv2. The attack Pass-The-Hash permits ...
Anonymous's user avatar
  • 274
0 votes
0 answers
283 views

Hyper-V-VMConnect with Kerberos rather than NTLM?

I am running Hyper-V for years. Recently I tried to harden my environment by applying GPOs that disable NTLM, as NTLM is discouraged by Microsoft. Now Hyper-V VMConnect stopped working and I keep ...
Joachim's user avatar
1 vote
2 answers
280 views

NTLM Modern usage

I understand that Kerberos is the recent authentication protocol used in windows environment and that NTLM is still supported for interoperability only. I want to know in non domain environments,if i ...
665bassem's user avatar
6 votes
1 answer
6k views

Is NTLM (over HTTPS) on IIS a good idea for a Internet-facing website

I am writing here since I have a huge doubt. I am performing a technical security assessment on a custom developed web application (ASP.NET). The application: is Internet-facing Uses HTTPS Uses IIS ...
Lux's user avatar
  • 63
0 votes
1 answer
458 views

Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?

Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
pmbonneau's user avatar
  • 191
2 votes
2 answers
3k views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
Jake Y's user avatar
  • 21
1 vote
1 answer
212 views

Is there any existing attempted implementation of GSS-API/SPNEGO/GSS-SPNEGO for anything other than Kerberos / NTLM?

I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?
Eran Medan's user avatar
3 votes
0 answers
263 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
Thiago Souza's user avatar
1 vote
0 answers
366 views

Is it secure to start a NTLM handshake not knowing if the server supports it?

I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests: import requests from requests_ntlm import HttpNtlmAuth requests.get("http://...
J. Doe's user avatar
  • 11
2 votes
1 answer
799 views

Does NTLM authentication via HTTP not need a user name?

Because of a vulnerability that has been found in Exchange Server I was trying to run that attack on our local system to see if the workaround can successfully prevent it. I found a description of ...
Arminius's user avatar
0 votes
1 answer
5k views

How to intercept ntlm authentication based application?

There is an internal application which authenticates based on windows credentials (NTLM Authentication). It is not intercepting while in proxy with Burp Suite and is stuck in login pop-up even after ...
Mridul Sengupta's user avatar
1 vote
0 answers
560 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
Benassin's user avatar
2 votes
1 answer
425 views

Obtain NetNTLM/NTLM hash or login

In one CTF, I encountered a task that is solved by getting NetNTLM \ NTLM or just getting username. Tell me, please, is there any protocol that automatically sends NetNTLM / NTLM or username, when ...
Sp1nal's user avatar
  • 21
2 votes
1 answer
3k views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
Dino's user avatar
  • 33
3 votes
1 answer
3k views

How is it that tools like Hashcat, JTR able to bruteforce an NTLMv2 hashes?

With regards to the following question about the feasibility of (brute|dictionary|rainbowtable)-forcing an NTLMv2 hash: How feasible is it for an attacker to brute-force an NTLMv2 response captured ...
Vicer's user avatar
  • 113
4 votes
1 answer
4k views

MsChapV2 authentication and Evil Twin attack

I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can ...
usern3t's user avatar
  • 41
0 votes
1 answer
218 views

Does Windows Authentication Use Secured Connection

I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
Sisyphus's user avatar
  • 133
2 votes
1 answer
1k views

NTLMv2 Hash harvesting remotely

I'm experimenting with ways to harvest NTLMv2 hashes remotely. Responder.py is perhaps the most widely used mechanism (these days) to perform the task, but I'm unsure if it's even possible to utilize ...
DKNUCKLES's user avatar
  • 9,217
1 vote
1 answer
11k views

Cant crack Responder hashes with John or Hashcat

I ran Responder in a test network and obtained hashes from a Windows machine. The logs for the machine show something like this (some bytes changed for security reasons) and are stored in a file ...
Lucas Cioffi's user avatar
0 votes
1 answer
7k views

John the Ripper Character Lists

How is it possible to use or prioritize umlauted characters - ä ö ü ß Ä Ö Ü - whilst brute forcing. I'm not using any wordlist, only dozens of CPU threads via the following command : ./john --fork=...
Parsa Samet's user avatar
3 votes
2 answers
2k views

How feasible is it for an attacker to brute-force an NTLMv2 response captured off the network?

According to the Wikipedia article on NTLM here: https://en.wikipedia.org/wiki/NT_LAN_Manager ..under the NTLMv2 description it mentions that NTLMv2 sends two responses to an 8-byte server ...
Vicer's user avatar
  • 113
3 votes
2 answers
9k views

Should I use rainbow tables or bruteforce (NTLM)?

As part of security testing, I will receive around 150 to 200 Active Directory password hashes from Windows Server 2012 R2 (using NTLM?). I have found NTLM rainbow tables (1,5 TB total), that covers ...
A J's user avatar
  • 77
1 vote
1 answer
326 views

Changing Structure of SAM database to disable LM usage

SAM database normally holds LM and NTLM hashes of local computer. Recently we applied configurations for disabling NTLMv1 usage in enterprise network . After that we mitigated LM hash usage on SMB ...
tesyer tteahn's user avatar
14 votes
1 answer
82k views

Understanding Windows local password hashes (NTLM)

I have recently dumped some hashes from my local machine because I'm trying to understand the process in which Windows 7 hashes it's passwords. I have discovered my local password hash that looks (...
13aal's user avatar
  • 275
22 votes
2 answers
69k views

How are Windows 10 hashes stored if the account is setup using a Microsoft account?

I was testing the integrity of my passwords and noticed that after I dumped the hashes, there was only one account where the NTLM hash was not a "default hash." I also know that that account happens ...
yasgur99's user avatar
  • 321
1 vote
1 answer
217 views

Is it possible to export user account certificates remotely with NTLM hash authentication?

The EFS encryption uses user certificate, generated with his username and password, to encrypt the files so that only that user can access it. My question is this: Can you export user certificates ...
Guesttt's user avatar
  • 31
3 votes
3 answers
6k views

NTLMv2 Reflection Attack

I am trying to figure out if NTLMv2 is vulnerable to a reflection attack. I cannot find a citation that clearly states NTLMv2 as being vulnerable. NTLMv1 is horribly insecure so there really is not ...
squarewav's user avatar
  • 189
1 vote
1 answer
2k views

Are Windows Hashes Encrypted in Transit?

When a user logs on with domain credentials on a Windows 7 machine, I assume that some sort of handshake happens with the logon server/domain controller, where the ntlm hash sent by the user is ...
user avatar
1 vote
3 answers
821 views

Why am I unable to capture LM & LMHASH?

I'm running a simple test of Metasploit's auxiliary/server/capture/smb. It works, but both LMHASH & LM are empty [*] SMB Captured - 2016-09-27 16:49:31 +0800 NTLMv2 Response Captured from 172.16....
daisy's user avatar
  • 2,077
0 votes
1 answer
238 views

NTML2 Session Response and Browsers

I've been looking at the NTML2 Session Response which is apparently supported transparently by commonly used browsers. NOTE: This is not to be confused with full NTLMv2 authentication. This in-depth ...
JimmyJames's user avatar
  • 3,049
0 votes
1 answer
87 views

Client app auto-updating passwords, no SSO [closed]

My customer has an ActiveDirectory server and a work server, both without SSO. Employees use their ActiveDirectory account to connect to the work server. They change passwords every month. My app ...
Nicolas Raoul's user avatar
1 vote
0 answers
590 views

Same value of WSS_KeepSessionAuthenticated cookie for different users after login

There is an application that uses NTLM authentication. After you enter your credentials, you get three cookies. I logged in with three different browsers(IE, chrome and mozilla) and as three different ...
one's user avatar
  • 1,821
3 votes
2 answers
1k views

Possible to connect to VNC server only with a NTLM Hash?

I'm using a training lab to learn computing security. And I retrieved the hash of the admin in this form: admin:1001:NO PASSWORD*********************:D4BF5A8658AFXXXXXXXX5B8DBB60859746::: So, I just ...
Addon's user avatar
  • 31
4 votes
3 answers
8k views

Are rainbow tables a viable tool for cracking NTLMv2 hashes?

Background I am unclear about the difference between NTLM hashes and the NTLM protocol, regardless of version. My tentative understanding is that there is such a thing as an "NTLMv2 hash", and that ...
sampablokuper's user avatar
10 votes
1 answer
61k views

Understanding NTLM Authentication Step by Step

I was reading this link on ASP.Net Authentication and Authorization and these 5 steps were there explaining NTLM authentication. Client sends the username and password to the server. Server ...
one's user avatar
  • 1,821