NTLM Hashing and Authentication

Play an AI-generated podcast conversation about this lesson

What hash version was passed to Responder?

Unknown

Version 3 (v3)

Version 2 (v2) (correct)

Version 1 (v1)

What type of file is created in the example?

Password list file

v1 file

Root file

v2 file (correct)

What is used to crack the password in the example?

Winexe

Responder

GitHub

John the Ripper (correct)

What is the password that John the Ripper successfully cracks?

vagrant Signup and view all the answers

What ruleset is used with John the Ripper in the example?

KoreLogic ruleset Signup and view all the answers

What can be accessed using the credentials obtained?

The target system remotely Signup and view all the answers

What is Winexe used for?

Remote administration of Windows systems Signup and view all the answers

What can Winexe be used to do on the target system?

Run applications Signup and view all the answers

What is the initial step in getting passwords with Responder?

Running Responder on the Kali Host Signup and view all the answers

What is observed on the Windows system during this process?

Only an 'Access is denied' message Signup and view all the answers

What is obtained from the output on the Kali box?

The IP address and username of the requesting host Signup and view all the answers

What is done with the obtained hash?

It is tried to be cracked to see if it works on the system Signup and view all the answers

Why is CTRL-C pressed on the Responder window?

To stop Responder from running Signup and view all the answers

What is the purpose of dumping hashes out of Responder?

To process them with John the Ripper Signup and view all the answers

What are the two new files generated after dumping hashes out of Responder?

DumpNTLMv1.txt and DumpNTLMv2.txt Signup and view all the answers

What type of hash can be seen on the next slide?

NetNTLMv2 Hash Signup and view all the answers

What was the purpose of creating NetNTLMv1 and NetNTLMv2 hashes?

To make hashes slower to crack Signup and view all the answers

What is used to add randomness to the NTLMv1 hash?

A server-based nonce Signup and view all the answers

What happens when a client connects to a host using NTLMv1?

The client asks for a nonce and then sends the hashed challenge to the server Signup and view all the answers

What is the purpose of the second nonce in NTLMv2?

To add complexity to the hash creation Signup and view all the answers

How does NTLMv2 protect against rainbow tables?

By using two different nonces Signup and view all the answers

What is the purpose of using Responder in capturing hashes?

To answer LLMNR and NBNS queries Signup and view all the answers

Why is using a fixed challenge on the server side beneficial when capturing hashes?

It allows us to deal with one set of randomness instead of two Signup and view all the answers

Where can the latest version of Responder be obtained?

From GitHub Signup and view all the answers

What is the purpose of running the Get-ComputerDetail.ps1 script?

To get computer details Signup and view all the answers

What is needed to perform certain activities on the domain?

A ticket or hash cached in the session Signup and view all the answers

What is the purpose of running the Invoke-Portscan.ps1 script?

To scan a port on the target Windows machine Signup and view all the answers

What is the tool used to spoof LLMNR and NetBIOS Name Services responses?

Responder Signup and view all the answers

What is used to crack credentials?

John the Ripper Signup and view all the answers

What is the purpose of the PowerView.ps1 script?

The purpose is not specified in the text Signup and view all the answers

What is required to perform some activities on the domain?

A full session on the system Signup and view all the answers

What is the purpose of using cmdlets like Invoke-WebRequest and Invoke-Expression?

To bring along our own code over the Internet Signup and view all the answers

What is the main theme of the summary?

Ways to get onto a target system without using an exploit Signup and view all the answers

What are the two ways Evil-WinRM can bring over code?

Scripts and binaries Signup and view all the answers

What does the -s flag specify in Evil-WinRM?

A script directory location Signup and view all the answers

What can be loaded from the script directory in Evil-WinRM?

Any scripts Signup and view all the answers

What happens when we type 'menu' in Evil-WinRM?

It lists all available scripts Signup and view all the answers

What is the purpose of Bypass-4MSI in Evil-WinRM?

To bypass Windows Antimalware Scan Interface Signup and view all the answers

How do you run a script in Evil-WinRM?

By typing the script name and then running 'menu' again Signup and view all the answers

What is included in the tool by default in Evil-WinRM?

Four commands: Dll-Loader, Donut-Loader, Invoke-Binary, and Bypass-4MSI Signup and view all the answers