NTLMv1 Downgrade Active Directory Privilege Escalation Tutorial

** IMPORTANT: In real environments, LmComparabilityLevel will need to be raised to 5. Slowly audit and test at each level.

Also, I missed one step between getting the output from hascat and putting the NTLM hash together. you have to convert the has at output from DES to NTLM with the hashcat tool 'deskey_to_ntlm'. It generates it instantly, THEN you out the strings together for the NTLM hash.**

This video will cover the "NTLMv1 Downgrade Attack", which allows a low level domain user to escalate privileges to Domain or Enterprise Admin. First we will describe the attack, perform the attack step-by-step, then cover the remediation for this attack.

Great blog about nvlmv1 vs ntlmv2

Network security: LAN Manager authentication level

DFSCoerce github

hashcat mask info

Forum form explaining the tool to convert NTLMv1 to DES

Convert NTLMv1 to DES github

Audit use of NTLM

Microsoft Doc: With Extended Session Security

00:00 Intro
00:33 Attack Details
09:20 Attack Walkthrough
15:27 Using Hashcat to Crack
25:00 Remediation - Audit
26:20 Remediation - Fix Configs

[dmustakasjr]

First 9 mins of setup is key. Penetration test(ers) need to know those key details in order to be able to fully demonstrate the technical information in any report to a client. Thank you for including that.

[nlinley]

Does the disable outbound ntlm gpo setting provide any protection on dc's that allow ntlm v1?