Capture
Last updated
Was this helpful?
Last updated
Was this helpful?
After successfully with LM or NTLM to an attacker's server, the attacker can try to recover credentials by capturing and (LM or NTLM hash, a.k.a. response) sent by the victim.
(Python) and (Powershell) are great tools able to do name poisoning for forced authentication attacks, but also able to capture responses (LM or NTLM hashes) by starting servers waiting for incoming authentications. Once those listening servers are up and ready, the tester can initiate the .
From UNIX-like systems, (Python) can be used to start servers listening for NTLM authentications over many protocols (SMB, HTTP, LDAP, FTP, POP3, IMAP, SMTP, ...). Depending on the authenticating principal's configuration, the NTLM authentication can sometimes be downgraded with --lm and --disable-ess in order to obtain NTLMv1 responses.
Testers should try to force a LM hashing downgrade with Responder. LM and NTLMv1 responses (a.k.a. LM/NTLMv1 hashes) from Responder can easily be cracked with . The tool (Python) can be used to convert captured responses to crackable formats by hashcat, and so on.
Machine account NT hashes can be used with the or techniques to gain admin access to it.