Collaborate Disseminate
I’m trying to understand the format of NTLMv2 hash. The following is an example I get from a website:
neo::MANGO:1122334455667788:2F6CC22CFDC387CFEEB2D325E8997564:0101000000000000C79708D95F14D2011D717D511A761654000000000200060053004D004200… Continue reading Understanding NTLMv2 Hash format [duplicate]
I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings.
In my understanding:
NTLM auth starts with a negotiation packet sent by the client. In this negotiation packet, the client describes w… Continue reading Downgrade of NTLM Authentication
I’m trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif.
Causing forced authentication which passes the NTLM hash.
I have the code which executes the pr… Continue reading Watering Hole Website NTLM Steal Attack
I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved.
After an interactive logon with kerberos, you will have in the cached credentials both kerberos tickets and ntlm hashes. I figured wi… Continue reading How NTLM SSO is preformed on smartcard Kerberos logon?
I’m planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users passwords.
Now I did some research, but there a… Continue reading Hardware for password cracking
I am concerned that if it is possible to copy these as .reg files (without privs) and then (on another machine) reverse the .hiv files from them… this would probably be bad, which makes me think it’s likely not possible.
Has this/is this… Continue reading Is the ability to export HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SYSTEM as .reg files a security concern?
I am running Responder on Kali Linux within a client network using the following command
sudo responder -I eth0 -w -r -d
which is capturing many hashes in the environment. Responder is a LLMNR, NBT-NS and MDNS poisoner used for MITM attac… Continue reading Running Responder outputs many hashes per user, how is this possible?
During a recent security audit, we found that a handful of accounts still have credentials identified as stored in LM hash format. For us, these were ancient service accounts and the like – easy enough to disable the credentials with group… Continue reading Discover AD accounts with LM Hashes
The tool Responder written in Python permits to listen on a specific network card requests and automatically poisoning victims the steal hash NTLMv1 and hash NTLMv2.
The attack Pass-The-Hash permits to connect to a service like SMB.
I am a… Continue reading Is it possible make a Pass-The-Hash attack with Responder?
I have done some research about NTLM and his challenge responses, and I have one last thing left unresolved. The LMv2 response, which is the newer version on of the old Lan Manager response, is documented as it will be in the packet only i… Continue reading LMv2 in NTLM authentication