Cracking NTLM
With a basic understanding of what NTLM hashes are and where we can find them,
let’s demonstrate obtaining and cracking them.
We’ll retrieve passwords from the SAM of the target machine.
We can log in to the system via RDP as user offsec,
using lab as the password.
We’ll begin by using Get-LocalUser to check which users exist locally
on the system.
The output indicates the existence of another user named nelly on the system.
Our goal in this example is to obtain nelly’s plain text password
by retrieving the NTLM hash and cracking it.
We already know that the credentials of users are stored
when they log on to a Windows system,
but credentials are also stored in other ways.
For example,
the credentials are also stored when a service is run with a user account.
We’ll use Mimikatz to check for stored credentials on the system.
Let’s start PowerShell again but as administrator.
We’ll change to the tools directory,
And start Mimikatz.
According to the prompt, Mimikatz is running and we can interact with it
through its commandline environment.
Each command consists of a module and a command delimited by two colons,
for example, privilege::debug enables SeDebugPrivilege access rights,
which are required for the following password and hash extraction commands.
We can use various commands to extract passwords from the system.
One of the most common Mimikatz commands is sekurlsa logonpasswords,
which attempts to extract plaintext passwords and password hashes
from all available sources.
Since this generates a huge amount of output,
we’ll instead use lsadump::sam, which will extract the NTLM hashes from the SAM.
For this command,
we must first enter token::elevate to elevate to SYSTEM user privileges.
The output shows that we successfully enabled the SeDebugPrivilege access right
and obtained SYSTEM user privileges.
The output of the lsadump::sam command reveals two NTLM hashes, one for offsec,
and one for nelly.
Since we already know that the NTLM hash of offsec was calculated
from the plaintext password “lab”, we’ll skip it and focus on nelly’s NTLM hash.
Let’s copy the NTLM hash and paste it into nelly.hash
in the passwordattacks directory on our Kali machine.
Next, we’ll retrieve the correct hash mode from Hashcat’s help output.
The output indicates that the correct mode is 1000.
We now have everything we need to start cracking the NTLM hash.
We’ve already extracted the hash because Mimikatz outputs a format
that Hashcat accepts.
The next step is choosing a wordlist and rule file.
For this example we’ll use the rockyou wordlist with the best64.rule rule file,
which contains 64 effective rules.
The output shows that we successfully cracked the NTLM hash of the nelly user.
The plaintext password used to create this hash is nicole1.
Let’s confirm this by connecting to the system with RDP.
Very nice!
We successfully cracked the NTLM hash and used the password to log in via RDP.
In this section we obtained a basic understanding of the SAM and NTLM hashes.
We also demonstrated how we can use Mimikatz to obtain NTLM hashes
and followed our cracking methodology to crack the hash.
While we did all of this on a local system without an Active Directory environment,
this process applies to enterprise environments
and is a crucial skill for most real-life penetration tests.
In the next section we’ll demonstrate how we can leverage NTLM hashes
even if we are unable to crack them.