Cracking Net-NTLMv2
In some penetration tests, we may obtain code execution
or a shell on a Windows system as an unprivileged user.
This means that we cannot use tools
like Mimikatz to extract passwords or NTLM hashes.
In situations like these,
we can abuse the Net-NTLMv2 network authentication protocol.
This protocol is responsible for managing the authentication process
for Windows clients and servers over a network.
Let’s capture and crack a Net-NTLMv2 hash.
We’ll set up Responder on our Kali machine
as an SMB server and use FILES01 as the target.
Let’s assume we used an attack vector to execute a bind shell on the target system.
We’ll connect to port 4444 with Netcat where our bind shell is running.
After we successfully connect,
we’ll use whoami to check which user is running the bind shell.
We’ll then use the net user command
to check if the user is a member of the local Administrators group.
The output shows the bind shell runs as the user paul,
which is not a local administrator on the FILES01 system.
Interestingly, the paul user is a member of the Remote Desktop Users group,
which allows the user to connect to the system with RDP.
For the sake of this demonstration,
let’s assume the user gunther (which we used in the previous section)
does not exist or we don’t have access to the account.
In this case, we only have access to paul on this system.
Since we don’t have privileges to run Mimikatz,
we cannot extract passwords from the system.
But we can set up an SMB server with Responder on our Kali machine,
then connect to it with the user paul and crack the Net-NTLMv2 hash,
which is used in the authentication process.
Let’s do this now.
First, we’ll need to run ip a to retrieve a list of all interfaces.
Then, we’ll run responder (which is already pre-installed on Kali)
as sudo to enable permissions needed to handle privileged raw socket operations
for the various protocols.
We’ll set the listening interface with -I,
noting that your interface name may differ from what’s shown here.
Our next step is to request access to a non-existent SMB share
on our Responder SMB server using paul’s bind shell.
Let’s switch back to the terminal tab
containing our Netcat bind shell connection and enter the command.
We’ll request access with a simple dir listing
in which “test” is an arbitrary directory name.
We are only interested in the authentication process,
not a share listing.
Now we’ll check the output in Responder.
The output indicates that Responder successfully captured paul’s
Net-NTLMv2 hash.
We’ll save this to paul.hash so we can crack it with Hashcat.
Before we start cracking, let’s retrieve the correct mode.
According to Hashcat, it is mode 5600.
Now let’s attempt to crack the hash using the rockyou wordlist.
The output shows that we successfully cracked paul’s Net-NTLMv2 hash.
Let’s confirm that the password is valid by connecting to FILES01 with RDP.
The output shows that we successfully connected to FILES01 with RDP as paul.