Anatomy of NTLMv1/NTLMv1-SSP

BSidesLV 2018

Presented by: Evil Mog
Date: Tuesday August 07, 2018
Time: 15:00 - 15:55
Location: Ground1234!

There has been some confusion about NTLMv1 and NTLMv1-SSP reversing to NTLM hashes using hashcats mode 14000. This was largely due to a talk at Derbycon that had some incomplete information combined with a few forum posts on hashcat.net.

In order to simplify the process as much as possible a tool called the NTLMv1 multi tool was created to automate most of the steps in converting an NTLMv1 and NTLMv1-SSP hash into a hashcat challenge file.

Evil Mog


KhanFu - Mobile schedules for INFOSEC conferences.
Mobile interface | Alternate Formats