Hacking Windows 10: How to Intercept & Decrypt Windows Passwords on a Local Network « Null Byte :: WonderHowTo

Hashes containing login passwords are transmitted between Windows computers on local Wi-Fi networks. By intercepting and decrypting these hashes using Responder and John the Ripper, respectively, we can learn a target's login credentials which can be later used to gain physical access to their computer.Why This Attack Is PossibleWhile communicating with other devices on a local network, Windows will use theLink-Local Multicast Name Resolution(LLMNR) protocol to perform hostname resolutions for devices on the local network. Any legitimate client on the local network can interact with the LLMNR protocol to assist Windows in resolving the hostname of another device on the network.The vulnerability lies in Windows' willingness to accept responses from any device on the network — even if the response is incorrect. There's no validation designed into the LLMNR protocol, which makes this vulnerability very easy to abuse.The attacker's machine will listen on the local network for LLMNR requests originating from the target Windows computer andrespondto the request. Believing the response is real, the Windows computer will attempt to negotiate a domain session with that server, sending the user's domain password in NTLMv2 hash format.The NTLM hashes used by LLMNR are highly valuable to attackers on the network.What Is NTLMv2?NTLMcredentials are based on data obtained during the interactive logon process and consist of a domain name, a username, and aone-way hashof the user's password. NTLM uses an encrypted protocol to authenticate a user without sending the user's password in plaintext over the network.Don't Miss:'Beast' Cracks Billions of Passwords in SecondsNTLM version 2 (NTLMv2), introduced into Windows operating systems in the late '90s, enhances NTLM security by hardening the protocol against many spoofing attacks and cryptographically strengthening the hashing algorithm to prevent brute-force attacks.Unfortunately, theHMAC-MD5hashing algorithm used by NTLMv2 is still highly susceptible to brute-forcing attacks, allowing for tens of millions of password attempts per minute — even when the attack is performed using older computers and Raspberry Pis.Step 1: Install & Use ResponderTo begin the attack, the NTLMv2 hash will need to be acquired from the target computer. This can be done usingResponder, a command line tool created bySpiderLabsandLaurent Gaffie, which is capable of sniffing and poisoningLLMNR,NBT-NS, andmDNSresponses. Responder is used to interact with Windows computers on the local network and capture NTLMv2 hashes transmitting from the target device.The tool can be found in theKali Linuxrepositories. To ensure the latest available version is installed, useapt-getupdatefirst before installing Responder. This can be achieved using the below commands, entered one by one.apt-get updateapt-get install responderWhen that's done, the--helpargument can be used to view Responder's available options.To start Responder, the below command can be used.responder -I wlan0If the built-in wireless card is being used to connect to the target wireless network, "wlan0" is most likely the name of the interface being used. The-Iargument is the only required argument to use Responder. The interface name can be found using theifconfigcommand.The Responder terminal will go into a "listening" state where it will respond to LLMNR requests happening on the local network. When the NTLMv2 hash belonging to the target Windows computer is discovered, Responder will print the hash in the terminal.The entire hash (highlighted in red) should be saved locally. This can be done usingnanoand saved to a file called "hash.txt."nano hash.txtNano can be closed and saved by pressingCtrl+X, thenY, thenEnter/Return.Step 2: Install John the RipperBrute-forcing the discovered hash is the final test of this attack, and for that, we'll be usingJohn the Ripper, a CPU-basedpassword cracker, currently available in most popular Linux distributions such as Kali Linux andParretSec.Don't Miss:How to Crack User Passwords in a Linux System with John the RipperJohn the Ripper's primary purpose is to detect weak passwords by performing a variety of brute-force attacks against common hash and encryption algorithms like password-protected ZIP files, PuTTY SSH private keys, encrypted Firefox password cache databases, macOS Keychains, Windows 10 NTLMv2 hashes, and much more.John the Ripper (referred to as onlyjohnfrom the command line) can be installed using the below command.apt-get install johnJohn the Ripper supports a wide range of hashing and encryption algorithms. The-testand-formatarguments can be used to benchmark John's cracking speed to determine how many NTLMv2 passwords a computer can attempt per second during brute-force attacks.john -test -format:netntlmv2To view benchmarks for all of the available hashing algorithms supported by John the Ripper, simply use-testwith no additional arguments.john -testStep 3: Brute-Force NTLMv2 Hashes with John the RipperThere are two ways you can go about doing this — the fast way and the slow way. Each way has its benefits and downsides, but it's good to know how each works regardless.Option 1: Use Wordlists to Crack the Hash (Fast)Using a wordlist against an NTLMv2 hash will likely process in a very short period of time. I found that John was able to process over 10,000,000 passwords in under 20 seconds. This is because NTLMv2 utilizes a weak hashing algorithm which fails to provide a reasonable degree of security. Even using older Intel CPUs, John is able to process millions of passwords in a very short period of time.To specify a desired wordlist for the brute-force attack, use the-wordlistargument.john -wordlist:passwords.txt hash.txtWhen a hash has been successfully cracked, it will appear in the terminal alongside the username associated with the hash. On my Windows 10 virtual machine,nullbyteis the password andIEUseris the username.Alternately, the hash can always be viewed again using the--showargument with the path to the file containing the hash.Option 2: Use John's Mask Mode to Crack the Hash (Slow)For readers with dedicated brute-forcing hardware or Raspberry Pis which can brute-force for days (or weeks) without being interrupted, John's "Mask Mode" may offer a more comprehensive solution.Mask mode allows for a more complete and thorough brute-force of the possible characters in a password. For example, "Password23" will likely be found in most brute-forcing wordlists, but "Pzzw1rD" will not. Using mask mode, John can try every possible character and number between A and Z, and 0 and 9, respectively.By default, John has pre-definedcharacter sets built-in. The character sets are as follows:?l = abcdefghijklmnopqrstuvwxyz?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ?d = 0123456789Password analytics based on leaked databasestell us that most passwords will be between six and eight characters and mostly consist of lowercase letters. This can be represented using the-maskargument and?loption as shown in the below command.john -mask=?l?l?l?l?l?l?l?l hash.txtEach "?l" represents one character in the password. The "l" here literally means "lowercase." A mask containing only uppercase letters will use "?u" instead.john -mask=?u?u?u?u?u?u?u?u?u hash.txtCombining masks character sets is also possible.john -mask=?u?l?l?l?l?l?l?l hash.txtAs mentioned previously, most passwords are between six and eight characters long. To save some time while performing brute-force attacks, a minimum word length can be enforced by using the-min-lenargument.john -mask=?u?l?l?l?l?l?l?l -min-len=6 hash.txtTo append digits to the end passwords, the?doption can be used.john -mask=?u?l?l?l?l?l?d?d -min-len=6 hash.txtTo view John's progress while the brute-force is still running, theDownarrow on the keyboard can be pressed to print information related to the brute-force and completion details.Don't Miss:John the Ripper Cheat Sheet by Luis Rocha (PDF)Readers with a greater interest in improving the speed of their brute-force attacks should exploreHashcatandGPU-based brute-forceattacks.Protect Yourself from Responder & Brute-Force AttacksPreventing these types of attacks isn't very easy, and there's only a few surefire things you can do to limit or eradicate your exposure.Use a stronger password.The weak hashing algorithm utilized by NTLMv2 means passwords upwards of 16 characters in length will propose a minor challenge for attacker's with dedicated brute-forcing machines at their disposal. Use of long, complex passwords is required here in order to combate local attackers.Disable LLMNR and NBT-NT protocols.The Windows protocols are literallyaskingto be compromised.Disable LLMNRanddisable NBT-NSif possible.Don't Miss:How to Create Stronger Passwords (Advice from a Real Hacker)Follow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Justin Meyers/Null Byte; Screenshots by tokyoneon/Null ByteRelatedHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCAndroid for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)How To:Intercept Images from a Security Camera Using WiresharkHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHack Like a Pro:How to Hack Remote Desktop Protocol (RDP) to Snatch the Sysadmin PasswordHacking Windows 10:How to Dump NTLM Hashes & Crack Windows PasswordsPSA:You Can Run Windows 10 Without a Microsoft AccountHow To:Recover Forgotten Wi-Fi Passwords in WindowsHow To:Find Saved WiFi Passwords in WindowsNews:Flawed Laptop Fingerprint Readers Make Your Windows Password Vulnerable to HackersHack Like a Pro:How to Grab & Crack Encrypted Windows PasswordsHacking Windows 10:How to Use SSH Tunnels to Forward Requests & Hack Remote RoutersHow To:Intercept Security Camera Footage Using the New Hak5 Plunder BugHow To:Use Acccheck to Extract Windows Passwords Over NetworksHow To:Identify Missing Windows Patches for Easier ExploitationHow To:Hack a Windows 7/8/10 Admin Account Password with Windows MagnifierHow To:Recover Passwords for Windows PCs Using OphcrackHow To:Hack WPA wireless networks for beginners on Windows and LinuxHow To:Remove a Windows Password with a Linux Live CDHow To:Add Ctrl+Alt+Delete to Windows 7 LogonHow To:Bypass Windows and Linux PasswordsHow To:Recover a Windows Password with OphcrackHow To:Encrypt your Skype Messages to Thwart Snooping Eyes Using PidginHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:log on Windows 7 with username & passwordHow To:Defend from Keyloggers in Firefox with Keystroke EncryptionHow To:How Hackers Take Your Encrypted Passwords & Crack ThemHow To:Carve Saved Passwords Using CainUncrackable File Sharing:Securely Transfer Your Secrets with 4096-Bit EncryptionHow To:Bypass a Local Network Proxy for Free InternetNews:Unmasked caller IDNews:Unmasked caller IDHow To:Reveal Saved Browser Passwords with JavaScript InjectionsNews:Windows Live SkyDriveHow To:Encrypt Your Sensitive Files Using TrueCryptHow To:Make a Gmail Notifier in PythonNews:VARIOUS WINDOWS ISSUES RESOLVED BELOW...How To:Sneak into Your Roommate's Computer by Bypassing the Windows Login Screen