NTLM Relay
Windows Authentication
LM | Was being used by default before windows vista, windows server 2008 (Weak hashing algorithm). |
NTLM (NT Hash) | Currently used for storing passwords at windows systems (Used for pass-the-hash attack). |
NTLMv1 (Net-NTLMv1) | Currently used for storing passwords at windows systems (Used for pass-the-hash attack). |
NTLMv2 (Net-NTLMv2) | Same as NTLMv1, just with some modification on the encryption algorithm. |
NTLM Authentication Mechanism
The user enters his username and password.
The client initiates a negotiation request with the server, that request includes any information about the client's capabilities as well as the Dialect or the protocols that the client supports.
The server picks up the highest dialect and replies through the Negotiation response message then the authentication starts.
The client then negotiates an authentication session with the server to ask for access.
The server responds to the request by sending an NTLM challenge.
The client then encrypts that challenge with his own pre-entered password’s hash (NTLM Hash) and sends his username, challenge, and challenge-response back to the server (Net-NTLM Hash).
The server tries to encrypt the challenge as well using its own copy of the user’s hash (NTLM Hash) which is stored locally on the server in case of local authentication, or pass the information to the domain controller in case of domain authentication, comparing it to the challenge-response, if equal then the login is successful.
Note: To use NTLM authentication instead of Kerberos authentication, access IP addresses instead of Hostnames dir \\10.0.2.100\c$
LM / NTLM Hashes are used for Pass-The-Hash attacks, while Net-NTLMv1 / Net-NTLMv2 Hashes are used for NTLM Relay attacks.
Pass-The-Hash will do all the same previous authentication processes because all these processes are based on the user's hash, not the user's password.
NTLM Relay attack takes place at the Session Setup Request Authentication step.
LLMNR & NBT-NS Poisoning
The victim wants to go to the print server at \printserver, but mistakenly typed in \pintserver.
The DNS server responds to the victim saying that it doesn’t know that host.
The victim then asks if there is anyone on the local network that knows the location of \pintserver.
The attacker responds to the victim saying that it is the \pintserver.
The victim believes the attacker and sends its own username and NTLMv2 hash to the attacker.
The attacker can now crack the hash to discover the password.
Responder
NTLM Cracking
NTLMv1 (Net-NTLMv1) Crack
NTLMv2 (Net-NTLMv2) Crack
NTLM Relaying
SMB Signing must be disabled, and this is the default setting except for the domain controllers.
Relay the hashes to another machine.
User must have admin access on this machine.
Responder with SMB & HTTP Disabled (in Responder.conf)
Determine the machines that have SMB signing disabled
Powershell Reverse Encoded Shell
Run ntlmrelayx.py script and pass to it the encoded reverse shell.
Metasploit multi handler to receive the shell.
Overall Process Overview
Machine 10.0.2.7 asks for an unknown host, then the attacker machine 10.0.2.15 responds to it with its own IP address, then machine 10.0.2.7 sends its credentials to the attacker machine 10.0.2.15 on port SMB, then the attacker machine takes these credentials and relays them to another machine 10.0.2.6, then machine 10.0.2.6 executed our reverse shell and the shell get back to us at 10.0.2.15.
Last updated