The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

24

Windows hashes are saved in SAM file (encrypted with SYSTEM file) on your computer regardless of the fact that you are using Microsoft account. It needs to be done this way to allow you to log in to your computer, even if you are not connected to the internet. If you change your password using account.microsoft.com, you will still be able to log in to your ...


9

Here is the wording from official source: The following steps present an outline of NTLM noninteractive authentication. The first step provides the user's NTLM credentials and occurs only as part of the interactive authentication (logon) process. (Interactive authentication only) A user accesses a client computer and provides a domain name, ...


8

Using [Jason, :, 502, :, aad3c435b514a4eeaad3b935b51304fe, :, c46b9e588fa0d112de6f59fd6d58eae3, :, :, :] as the example Jason is the user name 502 is the relative identifier (500 is an administrator, 502 here is a kerberos account.) (adsecurity.org/?p=483) aad3c435b514a4eeaad3b935b51304f is the LM hash c46b9e588fa0d112de6f59fd6d58eae3 is the NT ...


6

You can relay or forward an NTLMv2 response but the attacks may require scenario planning and/or tool changes. There may be advanced ways of cracking the hashes that you haven't yet thought about as well. For further information on relaying, check out -- http://www.room362.com/2014/05/effective-ntlm-smb-relaying.html http://blog.spiderlabs.com/2014/02/...


3

When you look at the documentation, you are looking for the terms "character set" and "charset" By default, the [Incremental:All] parameters are set to use the full printable US-ASCII character set (95 characters) The 95 characters do not include umlauts. But later, the documentation reads: If you've got a password file for which you already have a ...


3

It's not really about brute-forcing, dictionarying (is that a word?), or rainbow-tabling the NET-NTLMv2 creds, but more-so about comparing them to stored LM/NTLM hashes pulled from the flat-file SAM database or the in-memory LSASS process (which can usually be reversed to cleartext but in this case you actually want the hash for comparative purposes). Worse ...


3

I suspected the proxy to modify the list of supported ciphers and this problem came out again today when a website that I regularly visit stopped working saying that the connection was downgraded to a version of TLS lower than the minimum required by the server, an operation that my web browser wouldn't do. It is not possible to just modify the ciphers ...


3

username::DOMAIN:1122334455667788:stringof32numbersandletters:muchlargerstringofrandomnumbersandletters Username: username Domain or NTLM realm: DOMAIN Challenge: 1122334455667788 LM Hash: strongof32numbersandletters NTLM Hash: muchlargerstringofrandomnumbersandletters If you are wondering why you can't pass these hashes in the pass the hash attack, the ...


3

You need either of the hashes in order to 'pass the hash'. Here is some further reading for you if you're interested in learning more about it. https://www.sans.org/reading-room/whitepapers/testing/crack-pass-hash-33219


2

Well, first off with LanMan you have to remember that it was designed and implemented in a very, very different security context than we're facing today, or even than we were facing when NTLM & NTML v.2 were designed and implemented. It's probably going a little far to say that Microsoft--really, the tech industry in general--didn't care much at all ...


2

Reflection? Not unless the system has failed to patch MS08-068. Relay? Yes, NTLMv2 is vulnerable because of SMBv1/v2. Here are details on that attack -- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/november/introducing-chuckle-and-the-importance-of-smb-signing/ The SMB Relay and NTLM Relay attacks are thwarted if SMB signing is ...


2

NTLMv1 or NTLMv2 is a Windows Challenge-Response authentication protocol used in authenticating users in interactive and non-interactive logons. Interactive logons and non-interactive logons are explained here https://msdn.microsoft.com/en-us/library/gg604699.aspx and https://msdn.microsoft.com/en-us/library/windows/desktop/aa378749(v=vs.85).aspx NTLMv1 ...


2

When considering the risk applicable to brute-force attacks against user passwords in a Windows environment it is worth considering the nature of the compromise that will enable an attacker to capture a hash. For an attack that relies on a network capture of hashes during user authentication, rainbow tables will not be effective - the NTLMv2 protocol ...


2

Here is how I would approach this. Given, that you will encounter real-life passwords. I would start with a dictionary attack, given that NTLM is real fast on modern hardware you should be able to go through this quickly. Then, as suggested in the comments by Royce Williams, use rules, combinators and mask attack. This may take some time to set up but ...


2

Responder.py and MultiRelay are recompiled for win32, but I've used the Python scripts in Win10's Linux subsystem and they also appeared to work fine from there. I prefer purpleteam/snarf for NTLM Relay, but if all you want is hashes off-the wire then any pcap library/utility will be fine. If you are PowerShell-fluent you can use Inveigh. If you want to ...


2

Your Responder hash may be invalid, corrupt, or using an outdated format. Is it possible that you're using an older version of Responder, as noted in this question? Showing my work: Generally, the best way to validate your hashcat attack is correct for a specific hash type is to try your attack against an example hash from the hashcat wiki list of example ...


2

Your question is very broad, so honestly all I can do is give some very broad advise. You need to provide more information to get a more precise answer. In particular, try to ask yourself: What is your budget, both monetary and power-wise? How fast do you need these hashes cracked? How many hashes do you have that you will try to crack? What kind of people ...


1

TL;DR - You can trivially brute-force the DES keys used in the challenge/response mechanism. In order to reverse the challenge/response mechanism you only have to brute-force two DES iterations that have a 56-bit key. In order to obtain the NT hash, you will need to concatenate the challenge & the first two-thirds of your response and K3 as Base64. ...


1

Windows Authentication only refers to the authentication part and does not mean that the data you transfer are protected. You still need to use HTTPS for data protection.


1

Yes, it is quite feasable to do a dictionary attack on NTLMv2 challenge response. However, with only the response, it's not possible. The attacker needs both the challenge and response. In fact, its actually quite fast to crack. In fact, hackers often use a tool like Responder.py to capture NTLMv2 hashes and then use something like Hashcat to crack (or ...


1

If you need to "crack the hashes" you don't have hashes. You almost certainly have NTLM challenges and responses. Rainbow tables are useless against these, as they include random salt. If you have the hash, there is almost no situation where you can't pass the hash.


1

The cert's private keys are protection by DPAPI which uses the user's password as part of the KDF. That means that NTLM will not work, as the actual password never ends up on the remote host. https://msdn.microsoft.com/en-us/library/ms995355.aspx?f=255&MSPPError=-2147217396 You can export the certificate, but not the private key.


1

Even though NTLMv2 hashes do not have a true salt, it's still the case that the password alone is not the only thing being hashed. From your wiki link: Both LMv2 and NTv2 hash the client and server challenge with the NT hash of the user's password and other identifying information. The exact formula is to begin with the NT Hash, which is stored in the SAM ...


1

The attack is called NTLM relay, not reflection. NTLM, in any modern implementation, is immune to replay, not only a couple of implementations are immune to relay. Those that are include required NTLM signing. SMB/CIFS and LDAP can do this, not not HTTP. Posters are correct, this is not PTH. The attacker never gets the users NTLM hash. The key to the ...


1

Yes, in the case of interactive logon and any "windows" network based authentication, your hashes are protected in transit. Neither Kerberos nor NTLM sends a hash, instead the handshake uses various cryptography to prove the user knows the password without ever sending it. NTLMv1 uses VERY weak cryptography and is easily broken. NTLMv2 and Kerberos are ...


1

LM hashes over a network are disabled by default on post Windows XP systems. You will have to use a group policy/local security policy to enable that behaviour again. Changing the defaults was done obviously to prevent weak hashes being sent over the network for authentication. Microsoft figured that by the time a corporation had Windows 7, the environment ...


1

Sending your logged in user credentials (SSO) is limited only to the intranet zone. http based NTLM authentication is widely used inside corporate networks and is not considered a security risk unless an attacker managed to get a foothold inside your network. (which will happen) By default the intranet zone is defined by anything that's in the same subnet ...


1

Your application should be able to use ADFS or LDAP to send authentication questions to the AD, without your application having to know anything about the users and their passwords. You'd essentially use the AD as a directory server.


1

Yes, use psexec module from Metasploit.. however, for this to work port 445 should be open on the target. psexec module will require the username and password hash to deploy a meterpreter backdoor. once, achieved you can run the vnc post exploitation module and will be presented with a nice GUI of the target, All the best.


1

Forms-based authentication over proper, validated TLS is the modern way forward for web application authentication that require non-SSO (Single Sign On) capabilities (e.g., SAML, OpenID, OAuth2, FIDO, et al). NTLM authentication is only utilized in legacy networks. Microsoft no longer turns it on by default since IIS 7. Microsoft Domains and/or Forests with ...


Only top voted, non community-wiki answers of a minimum length are eligible