NTLMv1 reversion to NTLM with hashcat and the NTLMv1-multi tool
summary
NTLMv1 challenge/response is reversible: captured 8‑byte server and client challenges plus the 24‑byte NT response convert into three DES keys (21‑byte null‑padded NT hash), letting GPUs crack two DES keys and a short CPU crack for the last piece. Using responder/coercer to capture, ntlmv1-multi to format, then hashcat (mode 14000/5500) recovers keys — two L40/RTX‑490 class GPUs take ~72 hours, a CPU DES piece ~30s — then ntds DRS API can pull domain hashes and MS‑CHAPv2 allows hash-only Wi‑Fi auth.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:07NTLM hash fundamentals
- 2:30NTLMv1 challenge response
- 4:17NTLMv1 response generation
- 5:42GPU cracking NTLMv1
- 7:09Hashcat NTLMv1 conversion
- 9:13Capturing NTLMv1 hashes
- 11:18NTLMv1-multi setup
- 13:31Live demo prep
- 15:17Live demo hash capture
- 17:26ESS enabled vs disabled
- 18:08Processing hash with NTLMv1-multi
- 19:12Hashcat cracking NTLMv1
- 21:22DES keys to NTLM hashes
- 22:29Domain compromise
- 23:33NTLMv1 in wireless
- 24:37Q&A
- 25:21Stealth attacks
- 26:43Summary
related talks
30mThe Domain Password Audit Tool
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
47mFinding a Needle in an Encrypted Haystack
28mSo You Cracked a Bunch of Passwords. Now What?
47mCunning With CNG: Soliciting Secrets From Schannel
24mAn investigation of the effectiveness and security of pwds
58mHacking in 2016 - How is our systems broken?
29mWhy You Need to Detect More Than PtH