Capture the hash

This section will be focused on capturing the hash, the number-one step in a well-known attack: NTLM relay. As an introduction to this theme, I highly encourage you to read the most comprehensive guide about this attack[7].

Firstly, we need to cover a bit of a theory. The NTLM authentication protocol is used for network authentication and has two versions. It uses a zero-knowledge proof concept, meaning that credentials have never been transmitted over the network. It uses a challenge-response scheme, where the server sends a random set of data and client responses with a value, which is a result of hashing this data together with some extra parameters and the client’s secret key. As an attacker, we are interested in capturing this valid NTLM response from the client. Next, we can try to crack the hash or relay it.

NTLMv1 is deprecated and not considered secure. However, it is possible to see NTLMv1 in use in older environments. There are two techniques...