https://mkz.me/til/security/ Recent content in Security on mkz.me Hugo en-us Mon, 30 Sep 2024 12:49:43 +0200 https://mkz.me/til/security/decrypt-ntlm-v2-hmac-md5-hashes/ Mon, 30 Sep 2024 12:49:43 +0200 https://mkz.me/til/security/decrypt-ntlm-v2-hmac-md5-hashes/ <p>On a recent challenge, a <code>pcapng</code> file containing a ntlm2 authentication exchange was given and it was asked to find out the password.</p> <p>A hmac-md5 ntlm v2 auth is based on a server challenge, with which the client will compute a <code>NTProofStr</code> with the request data (ntlmv2 response without the ntproofstr).</p> <p><code>wireshark</code> decodes everything quickly, just find out the two packets:</p> <ul> <li>STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE that contains <code>NTLM Server Challenge</code>;</li> <li>NTLMSSP_AUTH, User: &lt;domain&gt;\user that contains the NTLMv2 response with the <code>NTProofStr</code> and the authentication data.</li> </ul> <h2 id="running-hashcat"> Running hashcat <a class="heading-link" href="#running-hashcat"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>An hashfile composed of the username, domain, server challenge, ntlm proof and data is required to try to crack the user password.</p>