CC13: NTLMv1 reversion to NTLM with hashcat and the NTLMv1-multi tool

Описание: EvilMog shows how a single NTLMv1 capture and Hashcat can yield domain‑controller hashes—100 % live demo, no safety net.

NTLMv1 may be “legacy,” but it still lurks in default policies and coercion bugs. In this CactusCon 13 session, EvilMog (X‑Force Chief Architect, Team Hashcat) walks through the NTLMv1‑multi helper script and demonstrates converting NTLMv1 challenge‑responses into full NT hashes by cracking the embedded DES keys.

What you’ll see:
Quick refresher on LM, NT, NTLMv1 & v2 and why LAN‑man compatibility levels matter.
How Responder plus Coercer forces a domain controller to hand over NTLMv1 data.
Live use of NTLMv1‑multi to split, format and feed DES keys to Hashcat (mode 14000).
Cloud‑GPU economics: ~$400 gets a full crack in a few hours—inside an average pen‑test window.
Converting cracked keys back to NT hashes, DCSyncing, and owning the domain.
Mitigations: set LAN‑man compat level ≥ 3, block NTLM on DCs, monitor ESS‑less auth.

Slides come straight from the terminal; if the demo breaks, foam balls are welcome.

00:00 Intro & acronym‑overload warning
00:22 Bio – EvilMog’s badges, Church of Wi‑Fi, Hashcat creds
00:47 Talk format: slides + live demo (no backups)
01:14 Windows password storage & NT‑hash basics
02:14 Common hash types – LM, NTLMv1/v2 modes
03:14 NTLMv1 challenge‑response flow (high level)
03:32 Negotiate → Challenge → Authenticate packet details
04:06 Responder & Coercer for forced authentication
06:26 ESS vs non‑ESS and rainbow‑table impact
07:15 Graphical breakdown of DES‑key splits
07:59 Exploitation plan – responder + coercer steps
08:50 Capturing a live NTLMv1 hash
09:18 Using ntlmv1‑multi to format for Hashcat
09:45 Hashcat cracking economics & timeline
11:55 Demo environment spin‑up
12:42 Running responder & coercer live
13:32 Formatting hash with ntlmv1‑multi
14:52 Pre‑cracked demo reveal
15:30 Converting DES keys to NT hash
16:00 netexec DCSync – full domain compromise
16:38 TL;DR – LAN‑Man level ≤ 2 means “already owned”
17:10 Mitigation tips & policy gotchas
17:52 Q&A, hash‑cracking trivia & close


#NTLMv1
#HashcatDemo
#CactusCon
#PasswordCracking
#RedTeam