<summary><strong>htARTE (HackTricks AWS Red Team Expert)</strong><ahref="https://training.hacktricks.xyz/courses/arte"><strong>!HackTricks</strong></a><strong>!</strong></summary>
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
In environments where **Windows XP and Server 2003** are in operation, LM (Lan Manager) hashes are utilized, although it's widely recognized that these can be easily compromised. A particular LM hash, `AAD3B435B51404EEAAD3B435B51404EE`, indicates a scenario where LM is not employed, representing the hash for an empty string.
By default, the **Kerberos** authentication protocol is the primary method used. NTLM (NT LAN Manager) steps in under specific circumstances: absence of Active Directory, non-existence of the domain, malfunctioning of Kerberos due to improper configuration, or when connections are attempted using an IP address rather than a valid hostname.
Support for the authentication protocols - LM, NTLMv1, and NTLMv2 - is facilitated by a specific DLL located at `%windir%\Windows\System32\msv1\_0.dll`.
**credentials/sessions** **AD****ask****printer****authenticate****host under your control****abuse**`metasploit auxiliary/server/capture/smb`**responder****authentication challenge****1122334455667788****authentication attempt****capture****authentication****NTLMv1****crack****yIlo'**.\
**printer** **computer account****authentication****computer accounts****long and random passwords****probably won't be able to crack****common dictionaries****NTLMv1****authentication****DES** ([more info here](./#ntlmv1-challenge)) **services****dedicated****cracking DES****crack****yIlo'** ([https://crack.sh/](https://crack.sh) **example**).
NTLM (NT LAN Manager) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users. It is commonly used in Windows environments for user authentication.
## NTLM Authentication Process
The NTLM authentication process involves the following steps:
1. The client sends a request to the server.
2. The server responds with a challenge.
3. The client encrypts the challenge using the user's password hash and sends it back to the server.
4. The server verifies the response by decrypting it and comparing it with the expected value.
5. If the response is valid, the server grants access to the client.
## NTLM Vulnerabilities
NTLM has several vulnerabilities that can be exploited by attackers:
1.**Pass-the-Hash (PtH) Attack**: An attacker captures the NTLM hash of a user and uses it to authenticate as that user without knowing the actual password.
2.**Pass-the-Ticket (PtT) Attack**: An attacker captures the Kerberos ticket of a user and uses it to authenticate as that user without knowing the actual password.
3.**NTLM Relay Attack**: An attacker intercepts the NTLM authentication request and relays it to another server, gaining unauthorized access.
4.**NTLM Downgrade Attack**: An attacker forces the use of weaker NTLM versions, making it easier to crack the password hash.
## Mitigation Techniques
To mitigate NTLM vulnerabilities, you can implement the following techniques:
1.**Disable NTLM**: Disable NTLM authentication and use more secure authentication protocols like Kerberos.
2.**Enforce Strong Password Policies**: Implement strong password policies to prevent easy cracking of password hashes.
3.**Enable SMB Signing**: Enable SMB signing to protect against NTLM relay attacks.
4.**Enable Extended Protection for Authentication**: Enable Extended Protection for Authentication to prevent NTLM downgrade attacks.
## Conclusion
NTLM is a widely used authentication protocol in Windows environments. However, it has several vulnerabilities that can be exploited by attackers. By implementing the mitigation techniques mentioned above, you can enhance the security of your Windows systems.
NTLM (NT LAN Manager) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users. It is commonly used in Windows environments for user authentication.
## NTLM Authentication Process
1. The client sends a request to the server.
2. The server responds with a challenge.
3. The client encrypts the challenge using the user's password hash and sends it back to the server.
4. The server verifies the response by decrypting it using the user's password hash.
5. If the response is valid, the server grants access to the client.
## NTLM Vulnerabilities
NTLM has several vulnerabilities that can be exploited by attackers:
1.**Pass-the-Hash (PtH) Attack**: An attacker captures the NTLM hash of a user and uses it to authenticate as that user without knowing the actual password.
2.**Pass-the-Ticket (PtT) Attack**: An attacker captures the Kerberos ticket of a user and uses it to authenticate as that user without knowing the actual password.
3.**NTLM Relay Attack**: An attacker intercepts the NTLM authentication request and relays it to another server, gaining unauthorized access.
4.**NTLM Downgrade Attack**: An attacker forces the use of weaker NTLM protocols, making it easier to crack the password hash.
NTLM (NT LAN Manager) is a suite of Microsoft security protocols that provide authentication, integrity, and confidentiality to users. It is commonly used in Windows environments for user authentication.
NTLM is a widely used authentication protocol in Windows environments. However, it has several vulnerabilities that can be exploited by attackers. By implementing the mitigation techniques mentioned above, you can enhance the security of your Windows systems and protect against NTLM-related attacks.
**The first response** is created by ciphering using **HMAC\_MD5** the **string** composed by the **client and the domain** and using as **key** the **hash MD4** of the **NT hash**. Then, the **result** will by used as **key** to cipher using **HMAC\_MD5** the **challenge**. To this, **a client challenge of 8 bytes will be added**. Total: 24 B.
If you have a **pcap that has captured a successful authentication process**, you can follow this guide to get the domain, username , challenge and response and try to creak the password: [https://research.801labs.org/cracking-an-ntlmv2-hash/](https://research.801labs.org/cracking-an-ntlmv2-hash/)
**Once you have the hash of the victim**, you can use it to **impersonate** it.\
You need to use a **tool** that will **perform** the **NTLM authentication using** that **hash**, **or** you could create a new **sessionlogon** and **inject** that **hash** inside the **LSASS**, so when any **NTLM authentication is performed**, that **hash will be used.** The last option is what mimikatz does.
* **atexec.exe** (In this case you need to specify a command, cmd.exe and powershell.exe are not valid to obtain an interactive shell)`C:\AD\MyTools\atexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local 'whoami'`
`Invoke-WMIExec` is a PowerShell script that allows you to execute commands on remote Windows systems using Windows Management Instrumentation (WMI). It leverages the `Win32_Process` class in WMI to create a new process on the target system and execute the specified command.
##### Usage
To use `Invoke-WMIExec`, you need to provide the following parameters:
-`-Target` : The IP address or hostname of the target system.
-`-Username` : The username to authenticate with on the target system.
-`-Password` : The password to authenticate with on the target system.
-`-Command` : The command to execute on the target system.
Here is an example of how to use `Invoke-WMIExec`:
This will execute the `ipconfig /all` command on the remote system with the specified credentials.
##### Limitations
-`Invoke-WMIExec` requires administrative privileges on the target system.
- The target system must have WMI enabled and accessible.
- The specified username and password must have administrative privileges on the target system.
##### Recommendations
- Use strong and unique passwords for the target system.
- Restrict access to the target system to only trusted IP addresses or networks.
- Regularly monitor and review WMI logs for any suspicious activity.
##### Disclaimer
This script is intended for authorized penetration testing and should only be used on systems that you have permission to test. Unauthorized use of this script may be illegal and could result in criminal and/or civil penalties.
`Invoke-SMBClient` is a PowerShell script that allows you to interact with the Server Message Block (SMB) protocol. It provides a command-line interface to perform various operations on SMB shares, such as listing files and directories, uploading and downloading files, and executing commands on remote systems.
To use `Invoke-SMBClient`, you need to have administrative privileges on the target system and have PowerShell installed. Once you have met these requirements, you can run the script and start interacting with SMB shares.
Here are some examples of how you can use `Invoke-SMBClient`:
Remember to replace `<target>`, `<share>`, `<local_file>`, `<remote_path>`, `<remote_file>`, `<local_path>`, and `<command>` with the appropriate values for your scenario.
`Invoke-SMBClient` can be a useful tool for interacting with SMB shares during penetration testing or other security assessments. However, it is important to use it responsibly and with proper authorization to avoid any legal or ethical issues.
`Invoke-SMBEnum` is a PowerShell script that can be used to enumerate information from SMB services. It leverages the `NetSessionEnum` and `NetShareEnum` functions to gather details about active sessions and shared resources on a target system.
To use `Invoke-SMBEnum`, you need to have administrative privileges on the target system. The script can be executed directly from a PowerShell session or incorporated into a larger script or tool.
The script takes the following parameters:
-`-ComputerName`: Specifies the target system(s) to enumerate. Multiple systems can be specified by separating them with commas.
-`-Credential`: Specifies the credentials to use for authentication on the target system(s). This parameter is optional, and if not provided, the current user's credentials will be used.
-`-Verbose`: Enables verbose output, providing additional details during the enumeration process.
Once executed, `Invoke-SMBEnum` will connect to the target system(s) using the specified credentials (or the current user's credentials) and retrieve information about active sessions and shared resources. The output includes details such as the username, computer name, session ID, and share name.
This script can be a valuable tool during penetration testing or security assessments, as it allows you to gather information about SMB services on target systems. By understanding the active sessions and shared resources, you can identify potential vulnerabilities or misconfigurations that could be exploited.
<summary><strong>Learn AWS hacking from zero to hero with</strong><ahref="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
