NTLM Authentication.
- NTLM stands for New Technology Lan Manager.
- NTLM is an authentication used in windows to authenticate a user.
- It is a challenge-response authentication protocol used by Windows systems to authenticate users without sending passwords over the network.
simple : NTLM authentication protocol hai jo windows systems me users ko authenticate krne ke lia use hota hai without passwords ko network par forward kia, sirf challenge-response mechanism se.
NTLM Auth Process :
step by step
- Client send a negotiate message to server to start authentication process. it includes NTLM supported features.
ex. Hey Server ! I want to login using NTLM.
2. The server responds with a random challenge (nonce) to client.
Prove, you know the password using this challenge.
3. Client sends a response for the challenge send by server.(response bhejna us challenge ka jo server ne dia tha client ko.
[this is most important part in this authentication. client server ko kya or kese bhejta hai ye part define karta hai. This is done by client.]
Converts password into NT hash (pass → hash me convert)
Encrypts the challenge using that hash. (challenge + NTLM Hash → response)
Sends the response back. (response → server)
Password kabhi bhi network pe send (transmit) nahi hota.4. Server verifies the response with database. Server retrives the NTLM Hash from database/ Active Directory. and compares it with the client response.
if match : login → successful
lf not match: login → not successful.
Tool : Responder , Impacket,
NTLM Authentication Attack scenerio :
- Attacker is sitting in the same network running a tool like Responder.
2. Attacker tricks User's system into sending an authentication request (e.g., fake share etc). (Tricking the user)
3. User's system unknowingly sends NTLM authentication to attacker.
4. Attacker captures this NT hash directly using tool.
5. Attacker forwards this authentication to real server using Impacket tool. ( NTLM Relay attack). (HASH → real server = relay attack).
6. Server thinks: "Oh, User is logging in" → grants access.
Responsible for this attack :
- NTLM does NOT verify the server identity.
Impact : attacker will get access
- File access
- Admin access
- Full domain takeover
Thanks for reading this article. we'll meet with new topics in our next article. Stay Safe ! Stay Healthy ! Soon 'll meet on youtube.
Follow on linkdlin and Instagram.
https://www.linkedin.com/in/sandeep-singh-tanwar-0605a126a/
https://www.instagram.com/_____psycho____00/