The Ethical Hacker Network - SMB Credentials

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Network Pen Testing (Moderator: don) > SMB Credentials

Pages: [1] Go Down

« previous next »

	Author	Topic: SMB Credentials (Read 4834 times)
0 Members and 1 Guest are viewing this topic.

jonas

Newbie

Offline

Posts: 46

SMB Credentials

« on: January 17, 2010, 02:54:20 PM »

I'm sorry if this was posted before...

Can anyone point me in the right direction for acquiring SMB credentials to a box on my LAN (vmware) without having access to the hashes? (Windows 7)

Is it possible to trigger some "hash-check" from the box and sniff the traffic or something along those lines? I read about ettercap converting the hash to l0ptrhack format. I'm guessing this would provide some better results with OpenVAS/Nessus.

Any links or help would be appreciated.

Thx!


	Logged

bamed

Newbie

Offline

Posts: 48

Re: SMB Credentials

« Reply #1 on: January 18, 2010, 07:13:09 AM »

H.D. Moore talks about NTLM hijacking in his Defcon 15 "Tactical Exploitation" talk: http://www.defcon.org/html/links/dc-archives/dc-15-archive.html#Moore


	Logged

chown -R bamed ./base

d3l0n

Jr. Member

Offline

Posts: 59

Re: SMB Credentials

« Reply #2 on: January 18, 2010, 08:00:30 PM »

Windows 7 uses NTLMv2 by default. Using Metasploit smb sniffer you will be able to get it.

But you should note that in NTLMv2 the server challenges the client and the client challenges the server this makes the process of cracking it to get the actual hash extremely hard when compared to NTLM which only uses the server challenge.