search

Retrieve Windows hashes

This page deals with retrieving windows hashes (NTLM, NTLMv1/v2, MSCASHv1/v2).

hashtag
Introduction

Windows hashes are the way Windows stores passwords on machines. First, let's clarify things.

  • NTLM (aka NT) hashes are local users hashes

  • NTLMv1/v2 (aka Net-NTLMv1/v2) hashes are used for network authentication

  • MSCASHv1/v2 (aka DCCv1/v2) hashes are domain users hashes

circle-exclamation

NTLM ≠ NTLMv1/v2 ≠ MSCASHv1/v2

hashtag
Retrieve NTLM hashes

NTLM hashes are composed of two parts:

  • LM hash (turned off since Windows Vista / Windows 2008)

  • NT hash (can be lonely, it stays NTLM hash)

NTLM hash

NTLM hashes are stored into SAM database on the machine, or on domain controller's NTDS database. Let's see common techniques to retrieve NTLM hashes.

hashtag
Dumping SAM database manually

First, get a copy of SAM, SECURITY and SYSTEM hives:

Then retrieve NTLM hashes with secretdump from impacket:

hashtag
Retrieve and crack NTLM hashes with Meterpreter

On local machines, simply use smart_hashdump:

On domain controllers, two ways to retrieve domain users NTLM hashes:

triangle-exclamation

LSASS injection technique is not a safe and must be avoided!

To crack NTLM hashes, use John integration:

hashtag
Retrieve NTLM hashes with Mimikatz

Use the following commands into Mimikatz:

These hashes are the NT part. To get full NTLM format, just add the empty LM part: aad3b435b51404eeaad3b435b51404ee:<NThash>

hashtag
Retrieve NTLM hashes remotely with Secretsdump:

hashtag
Retrieve NTDS remotely:

You can use secretsdump, again:

Or CrackMapExec:

circle-check

NTLM hashes can :

  • be used with Pass-the-Hash technique

  • be cracked pretty easily

hashtag
Retrieve NTLMv1/v2 hashes

NTLMv1/v2 hashes are derived from a challenge/response algorithm and are based on the user's NT hash.

Authentication using NTLMv2

  1. Alice access to the share

  2. Fileserver generate a challenge (random number) and send it to Alice

  3. Alice send challenge answer obtained by passing to a function her NTLM hash and the challenge

  4. File server ask domain controller to perform the computation and compare the results

  5. Domain controller says it is ok

  6. Alice can access to the fileserver

NTLMv2 (aka Net-NTLMv2) hash

These hashes can be retrieved with tools like Responderarrow-up-right or Inveigharrow-up-right:

circle-check

NTLMv1/v2 can:

  • be relayed (with tools like MultiRelay of ntlmrelayx)

  • be cracked in a reasonable time

  • be used with Pass-the-Hash technique, no it cannot.

hashtag
Retrieve MSCASHv1/v2 hashes

Let's say the machine you are trying to connect to cannot access the domain controller to authentication due to network outage or domain server shutdown. You are stuck. To solve that problem, machines stores hashes of the last (10 by default) domain users that logged into the machine. These hashes are MSCASHv2 hashes.

Let's see common techniques to retrieve these hashes.

hashtag
Dumping SAM database manually

First, get a copy of SAM, SECURITY and SYSTEM hives:

Then retrieve MSCASH hashes with secretdump from impackets:

hashtag
Retrieve MSCASH hashes with Meterpreter

Simply use cachedump Meterpreter module:

circle-check

MSCASHv2 can:

  • be cracked in quite a long time

  • be used with Pass-the-Hash technique, no it cannot.

hashtag
References

PreviousRetrieve Windows passwordsNextMaintening Access

Last updated