Internal Network Security: NTLM Authentication Process and Pass-the-Hash Principles

NTLM Authentication Process and Pass-the-Hash Principles

0x01 Local Authentication Process

The operating system displays the login screen. After receiving the entered password, it passes the password to the LSASS process, which stores a copy of the plaintext password. The plaintext password is encrypted into an NTLM hash and compared against the SAM database for authentication.

Notes:

winlogon.exe (Windows Logon Process) is used to manage user logins and logouts.
LSASS is part of the Microsoft Windows security mechanism and is used for local security and login policies.

0x02 Network Authentication

On internal networks, early versions of the SMB protocol transmitted plaintext passwords over the network. LM hashes were later introduced, but they were easy to crack. NTLM and Kerberos are now also available.

LM Hash and NTLM Hash

Passwords in the Windows operating system are encrypted in two forms: LM Hash and NTML Hash.

NTLM Hash

The standard method for encrypting a plaintext password into an NTLM hash is as follows:

password ----> 十六进制编码 ----> Unicode转换 ----> MD4加密 ----> 得到NTLM Hash

For example:

admin -> hex(16进制编码) = 61646d696e

61646d696e -> Unicode = 610064006d0069006e00

610064006d0069006e00 -> MD4 = 209c6174da490caeb422f3fa5a7ae634

	2000	XP	2003	Vista	Windows 7	2008	2012
LM	√	√	√
NTLM	√	√	√	√	√	√	√

Since Server 2003, Windows authentication has used NTLM hashes.

Starting with Server 2008, LM hashes are disabled by default. When a password exceeds 14 characters, NTLM encryption is used.

Therefore, most Windows systems use the NTLM protocol for authentication, while the LM protocol has largely been phased out.

NTLMv2 Protocol

NTLM is a Windows network authentication protocol. It is an authentication model based on the Challenge/Response authentication mechanism.

Differences between NTLMv1 and NTLMv2:

Both are based on NTLM hash encryption	NTLMv1	NTLMv2
Different encryption algorithms
Challenge	8 characters	16 characters
Net-NTLM hash	The primary encryption algorithm is DES	The primary encryption algorithm is HMAC-MD5

0x03 NTLM Authentication

The NTLM protocol authentication process consists of three steps:

Negotiation (primarily used to confirm the protocol versions supported by both parties)
Challenge (the Challenge/Response model)
Verification (authentication is completed)

The NTLM hash is never transmitted over the network during the entire process.

0x04 Pass the Hash (PTH) Principles

Main purpose:

Pass the Hash is a technique that enables authentication without requiring the account’s plaintext password.

Prerequisites:

Obtain the administrator’s password or NTLM hash:

The username used for authentication (required in the first step of the challenge)
The authenticating user’s NTLM hash

Principle:

Pass the Hash involves impersonating a client and proceeding in the same way as normal NTLM authentication.

The NTLM hash corresponding to the username is used with the Challenge provided by another host to generate a Response and complete authentication.

Personally, I do not think this really counts as a vulnerability; it is more of a technique.

Usage:

Run mimikatz with administrator privileges on the target machine.

mimikatz.exe "privilege::debug" "sekurlsa::pth /user:<用户名> /domain:<域名> /ntlm:<NTML Hash>"

Bypassing the Patch to Perform Pass the Hash

When the system has the KB2871997 patch installed, conventional Pass-the-Hash attacks can no longer be used.
However, Pass the Hash can still be used with the Administrator account whose SID is 500, or AES-256 can be used to perform Pass the Hash.

Extract the AES-256 key:

mimikatz.exe "privilege::debug" "sekurlsa::ekeys"

Run mimikatz with administrator privileges:

mimikatz "privilege::debug" "sekurlsa::pth /user:Administrator /domain:zeo.com /aes256:<AES-256密钥>"

Many other tools are also available, including MSF, CS, Impacket, and Smbexec.