NTLM Downgrade Attack Techniques

This article describes a method for obtaining a NetNTLMv1 hash through an NTLM downgrade attack and then cracking the NetNTLMv1 hash to recover the more widely usable NTLM hash.

NTLM / NetNTLMv1 / NetNTLMv2

NTLM (New Technology LAN Manager) is a suite of security protocols provided by Microsoft for authenticating user identities. It is based on a challenge-response mechanism and does not require a user's plaintext password to be transmitted during authentication.

During the challenge-response process, the client receives a challenge from the server and encrypts it using the user's password hash to generate a response. This response is known as the NetNTLM response. NetNTLMv2 is a newer version of the NetNTLM response, while its earlier version is NetNTLMv1.

NetNTLMv2 and NetNTLMv1 are used for the same authentication process, but NetNTLMv2 provides stronger security. It uses more complex cryptographic methods and a longer challenge, making password cracking more difficult.

Therefore, red teams may attempt to downgrade the NTLM negotiation process to obtain NetNTLMv1 responses, which are easier to crack.

NTLM Downgrade

We prepared a Windows Server 2019 test system and changed the login account password to an extremely long password that would be difficult to crack, as shown below:

Compile and run Internal-Monologue with administrator privileges. The program downgrades NTLM and automatically obtains the NetNTLMv1 hash:

The NetNTLMv1 hash obtained is: 480c165778cfecf2a48f9e6f0191369994e8d011e8dc44d5

NetNTLMv1 -> NTLM

Next, we use ntlmv1.com to crack the NetNTLMv1 hash, as shown below:

The successfully recovered result is the commonly used NTLM hash: 73b636dd3af905cda7c6bcd84a09a278

Generate an NTLM hash from the configured password to verify that the recovered result is correct:

Advantages of NTLM Downgrade Attacks

• Obtain the NTLM hash without accessing the LSASS process
• Permanently weaken the target system's password security level until the NTLM negotiation level is restored

Although there are other potential behavioral indicators that can be used to detect downgrade attacks, if you are already aware of them, bypassing those detections should also be straightforward. 🙂

References

https://book.hacktricks.xyz/windows-hardening/ntlm
https://github.com/eladshamir/Internal-Monologue
https://www.hackingarticles.in/ntlm-downgrade-attack-internal-monologue/
https://www.freebuf.com/articles/web/350726.html
https://zhuanlan.zhihu.com/p/637258145