NTLMv2 Hash Theft¶

What Is NTLMv2 Hash Theft?¶

NTLMv2 hash theft (also called NTLM coercion or forced authentication) is a class of attacks that trick a Windows system into initiating NTLM authentication to an attacker-controlled server. When this happens, the victim's Net-NTLMv2 challenge/response hash is sent over the network and can be:

1. Captured — for offline password cracking (hashcat mode 5600)
2. Relayed — forwarded to another service to authenticate as the victim (ntlmrelayx)

This is one of the most versatile and widely-used attack techniques in Active Directory penetration testing.

The Core Mechanism¶

Every technique in this section follows the same fundamental flow:

sequenceDiagram
    participant Attacker as 🔴 Attacker<br/>(Responder/ntlmrelayx)
    participant Victim as 🖥️ Victim<br/>(Windows)
    participant SMB as 📁 Attacker's<br/>SMB Server

    Note over Attacker: Set up capture server<br/>(Responder, Inveigh, etc.)
    Attacker->>Victim: Deliver trigger<br/>(file, link, coercion RPC)
    Victim->>SMB: SMB Connection<br/>(automatic NTLM auth)
    SMB-->>Attacker: Net-NTLMv2 Hash Captured
    Note over Attacker: Crack with hashcat<br/>OR relay to target service

Why it works: Windows automatically attempts NTLM authentication when a process tries to access a UNC path (\\server\share). Many Windows features — file icons, search indexing, Office document loading, media playlists — resolve UNC paths without explicit user consent.

Capture Infrastructure¶

Before using any coercion technique, you need a server to capture the incoming authentication:

What To Do With Captured Hashes¶

Option 1: Offline Cracking¶

# hashcat — mode 5600 is Net-NTLMv2
hashcat -m 5600 captured_hashes.txt /path/to/wordlist.txt -r /path/to/rules.rule

Option 2: NTLM Relay¶

Instead of cracking, relay the authentication to another service in real-time:

# Relay to LDAP on a Domain Controller (for AD object modification)
ntlmrelayx.py -t ldaps://dc01.corp.local --escalate-user attacker

# Relay to ADCS web enrollment (ESC8 — instant Domain Admin)
ntlmrelayx.py -t http://ca01.corp.local/certsrv/certfnsh.asp --adcs --template DomainController

Option 3: Pass-the-Hash (if you crack it)¶

Once cracked, the cleartext password enables: - Pass-the-Hash with the NT hash - Kerberos ticket requests - Full authenticated access

Section Contents¶

This knowledge base section is divided into:

Key CVEs (2020–2026)¶

Defense Quick Reference¶