NTLMv1
NT LAN Manager version 1 (NTLMv1) is vulnerable to several attacks and should be disabled in environments whenever possible. All Microsoft operating systems support its successor NT Lan Manager version 2 (NTLMv2) which should be used instead.
A NTLMv1 hash is formatted like the following:
Downgrading
It is possible in environments where NT LAN Manager version 1 is utilized to obtain an NTLMv1 hash from a target computer.
While this was partially described in the Coercion section, prior to receiving a callback we need to run Responder, after modifying the 'Challenge' variable to 1122334455667788. We can then run Responder with the following options:
Cracking NTLMv1
Referencing crack.sh, a NTLMv1 hash with ESS/SSP looks like the following:
After obtaining a hash with ESS/SSP, we first need to reformat the obtained hash using EvilMog's NTLMv1-multi tool or assless-chaps and cracked with a database of NT hashes.
If we weren't able to remove the ESS/SSP with Responder then it will no longer be possible to crack with crack.sh’s rainbow tables. Instead, it can be submitted and crack on crack.sh for a fee.
Attacking a Domain Controller
If NTLMv1 is enabled, you can leverage the ability where DC's have the ability to modify their own msDS-KeyCredentialLink attribute. It should be noted this requires two domain controllers to exploit.
References
Last updated
