NTLMv2 Hash Coercion & Leaking¶

What Is NTLM Coercion?¶

NTLM coercion (also called "forced authentication" or "hash disclosure") is a class of attacks that trick a Windows system into initiating an NTLM authentication handshake with an attacker-controlled server. When this happens, the victim's NTLMv2 challenge-response hash (Net-NTLMv2) is transmitted over the network and can be:

1. Captured — for offline cracking with hashcat/john
2. Relayed — forwarded in real-time to another service (NTLM relay attacks)
3. Used for lateral movement — via pass-the-hash or relay-to-LDAP for AD escalation

Attack Categories¶

Section Contents¶

Quick Reference: File Types That Leak NTLMv2¶

Core Tooling¶

The Capture Chain¶

Regardless of coercion method, the exploitation follows the same pattern:

flowchart LR
    A["🎯 Victim"] -->|"Coerced SMB/HTTP<br/>auth request"| B["🔴 Attacker<br/>(Responder/ntlmrelayx)"]
    B -->|"Capture hash"| C["💾 NTLMv2 Hash"]
    C -->|"Option 1"| D["🔓 Offline Crack<br/>(hashcat -m 5600)"]
    C -->|"Option 2"| E["🔀 Relay to Target<br/>(ntlmrelayx)"]
    D --> F["🔑 Plaintext Password"]
    E --> G["⚡ Authenticated Action<br/>(DCSync, Shadow Cred,<br/>ACL abuse)"]

Hashcat Mode Reference¶

# Crack NTLMv2 hash captured by Responder
hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Defense Summary¶