NTLM

• A suite of Microsoft security Protocol for authenticating users and computers based on a challenge-response mechanism.
• The client sends a hashed password to the server, which challenges the client to prove it knows the password without sending it over the network.
• Microsoft introduced the NT LAN Manager (NTLM) hash in 1993 with Windows NT 3.1. NTLM hashes use MD4 to hash passwords in UTF-16 Little Endian format, supporting longer and more complex passwords without the limitations of the LM Hash.

NTLM V2

• User passwords are stored as NT hashes (MD4 hash of the Unicode password)

• NTLMv2 hash = HMAC-MD5(NT hash, uppercase(username) + domain)

• NTLMv2_response = temp + blob

  • temp = HMAC-MD5(NTLMv2_hash, server_challenge + blob) 

• Challenge Response Auth method

  • User sends a negotiation message
    • Domain Name
  • Domain Controller sends a challenge (Random Nonce)
  • Client Sends NTLMv2 Response
  • Server Verifies NTLMv2 response

Weakness

• MD4 has known collision attacks since 2004
• MD5 has collision attacks and is considered insecure
• Pass-the-Hash attacks
• Dictionary Attacks
• Hash Relay attacks