CC13: NTLMv1 reversion to NTLM with hashcat and the NTLMv1-multi tool скачать в хорошем качестве

CC13: NTLMv1 reversion to NTLM with hashcat and the NTLMv1-multi tool

EvilMog shows how a single NTLMv1 capture and Hashcat can yield domain‑controller hashes—100 % live demo, no safety net. NTLMv1 may be “legacy,” but it still lurks in default policies and coercion bugs. In this CactusCon 13 session, EvilMog (X‑Force Chief Architect, Team Hashcat) walks through the NTLMv1‑multi helper script and demonstrates converting NTLMv1 challenge‑responses into full NT hashes by cracking the embedded DES keys. What you’ll see: Quick refresher on LM, NT, NTLMv1 & v2 and why LAN‑man compatibility levels matter. How Responder plus Coercer forces a domain controller to hand over NTLMv1 data. Live use of NTLMv1‑multi to split, format and feed DES keys to Hashcat (mode 14000). Cloud‑GPU economics: ~$400 gets a full crack in a few hours—inside an average pen‑test window. Converting cracked keys back to NT hashes, DCSyncing, and owning the domain. Mitigations: set LAN‑man compat level ≥ 3, block NTLM on DCs, monitor ESS‑less auth. Slides come straight from the terminal; if the demo breaks, foam balls are welcome. 00:00 Intro & acronym‑overload warning 00:22 Bio – EvilMog’s badges, Church of Wi‑Fi, Hashcat creds 00:47 Talk format: slides + live demo (no backups) 01:14 Windows password storage & NT‑hash basics 02:14 Common hash types – LM, NTLMv1/v2 modes 03:14 NTLMv1 challenge‑response flow (high level) 03:32 Negotiate → Challenge → Authenticate packet details 04:06 Responder & Coercer for forced authentication 06:26 ESS vs non‑ESS and rainbow‑table impact 07:15 Graphical breakdown of DES‑key splits 07:59 Exploitation plan – responder + coercer steps 08:50 Capturing a live NTLMv1 hash 09:18 Using ntlmv1‑multi to format for Hashcat 09:45 Hashcat cracking economics & timeline 11:55 Demo environment spin‑up 12:42 Running responder & coercer live 13:32 Formatting hash with ntlmv1‑multi 14:52 Pre‑cracked demo reveal 15:30 Converting DES keys to NT hash 16:00 netexec DCSync – full domain compromise 16:38 TL;DR – LAN‑Man level ≤ 2 means “already owned” 17:10 Mitigation tips & policy gotchas 17:52 Q&A, hash‑cracking trivia & close #NTLMv1 #HashcatDemo #CactusCon #PasswordCracking #RedTeam