Kerberos and NTLM Security Vulnerabilities

  1. NTLM Security Vulnerabilities
    1. Credential Extraction Attacks
      1. LSASS Memory Dumping
        1. Process Memory Access
          1. MiniDumpWriteDump API
            1. Task Manager Method
              1. ProcDump Utility
                1. Privilege Requirements
                2. SAM Database Extraction
                  1. Offline Registry Access
                    1. Volume Shadow Copy Service
                      1. Live System Extraction
                        1. Registry Hive Copying
                        2. Cached Credential Extraction
                          1. MSCache Hash Format
                            1. Domain Cached Credentials (DCC)
                              1. DCC2 Hash Format
                            2. Pass-the-Hash Attacks
                              1. Attack Methodology
                                1. Hash Acquisition
                                  1. Authentication Bypass
                                    1. Session Establishment
                                    2. Technical Implementation
                                      1. NTLM Authentication Flow Abuse
                                        1. Token Manipulation
                                          1. Process Injection
                                          2. Attack Tools
                                            1. Mimikatz
                                              1. Windows Credential Editor (WCE)
                                                1. Metasploit Modules
                                                  1. PowerShell Empire
                                                  2. Lateral Movement Techniques
                                                    1. WMI Execution
                                                      1. PsExec-style Tools
                                                        1. Remote Service Creation
                                                      2. NTLM Relay Attacks
                                                        1. Attack Prerequisites
                                                          1. Man-in-the-Middle Positioning
                                                            1. SMB Signing Disabled
                                                              1. Target Service Identification
                                                              2. SMB Relay
                                                                1. NetBIOS Name Service Poisoning
                                                                  1. LLMNR Poisoning
                                                                    1. Responder Tool Usage
                                                                      1. Cross-Protocol Relay
                                                                      2. HTTP/HTTPS Relay
                                                                        1. Web Application Integration
                                                                          1. NTLM over HTTP
                                                                            1. Cross-Site Request Forgery (CSRF) Integration
                                                                            2. Multi-Relay Attacks
                                                                              1. Relay Chain Establishment
                                                                                1. Privilege Escalation Through Relay
                                                                              2. Hash Cracking Attacks
                                                                                1. Offline Brute Force
                                                                                  1. Dictionary Attacks
                                                                                    1. Hybrid Attacks
                                                                                      1. Mask Attacks
                                                                                      2. Rainbow Table Attacks
                                                                                        1. Precomputed Hash Tables
                                                                                          1. Time-Memory Trade-off
                                                                                            1. LM Hash Vulnerability
                                                                                            2. Cracking Tools
                                                                                              1. Hashcat
                                                                                                1. John the Ripper
                                                                                                  1. Ophcrack
                                                                                                    1. Custom Scripts

                                                                                                Previous

                                                                                                2. NTLM Protocol Architecture

                                                                                                Go to top

                                                                                                Next

                                                                                                4. Kerberos Protocol Fundamentals