BoomerSec: 25 Years of Abusing Microsoft Windows Passwords

### Overview In this talk, Joe Mocan (also known as JMK) reflects on 25 years of Windows password attacks and penetration testing history, focusing on tools and techniques developed by the Fufus.net team based out of Madison, Wisconsin. Walking through the evolution of Windows authentication from late-1990s legacy hashing to modern relay attacks, Mocan explains how offensive methodologies evolved alongside defensive mitigations. The presentation bridges foundational tools of the early 2000s—such as Samba patches, Hydra modifications, OWNER, Medusa, and FGDump—to contemporary security concepts like BloodHound and NTLM relaying to WinRM.

### Key Topics - **History of Windows Hashes and Passing the Hash**: The architectural differences between LM (LAN Manager) and NTLM hashing algorithms, their lack of salting, and how an NT BugTraq post in 1997 modifying Samba enabled pass-the-hash attacks without recovering cleartext passwords. - **Early Attack Tooling and Password Guessing**: The development of tools at Fufus.net, including modifying THC Hydra to support SMB brute-forcing and pass-the-hash, releasing OWNER (Opportunistic Windows Network Reporting Tool) for null-session reconnaissance, and transitioning to Medusa and FGDump to bypass Data Execution Prevention (DEP) and avoid antivirus-induced system crashes. - **Graph Theory in Identity Security**: Early efforts in 2006 to represent compromised systems and shared local admin credentials using graph visualizations (such as the speaker's 'Pac-Man' diagram), anticipating modern Active Directory graphing tools like BloodHound. - **NTLM Network Authentication and Coercion**: The mechanics of NTLM challenge-response handshakes, coercing client authentications via broadcast protocols (such as WPAD) or outbound SMB UNC paths in HTML email image tags, and cracking responses via custom John the Ripper formats (which coined the term 'net NTLM'). - **NTLM Authentication Relaying to WinRM**: Tracing relaying milestones from Zack Attack to ntlmrelayx across SMB, LDAP, and Active Directory Certificate Services (ADCS), concluding with research into relaying NTLM to WinRM over HTTPS (TCP 5986).

### Technical Details - **Hashing Deficiencies**: LM hashing capitalizes passwords, truncates them at 14 characters, splits them into two 7-byte DES keys, and hashes a fixed magic string starting with 'KGS', making it vulnerable to rainbow tables. NTLM uses an unsalted MD4 hash of the Unicode password. Because neither is salted, identical passwords yield identical hashes across machines. - **DEP and LSASS Injection**: Early hash dumpers like PWDump3e injected code directly into the LSASS process. When Windows introduced Data Execution Prevention (DEP), this injection triggered LSASS crashes that rebooted target hosts. Fizgig created PWDump6 and FGDump to disable DEP during extraction, remotely stop antivirus services (like McAfee or Symantec), and dump hashes safely at scale. - **WinRM Relay Mechanics**: WinRM over HTTP (TCP 5985) encrypts message bodies using the client's NTLM hash, preventing relay. WinRM over HTTPS (TCP 5986) does not encrypt the body because it relies on TLS, but it supports Channel Binding Tokens (CBT). Because WinRM's default CBT setting is 'relaxed', servers do not require CBT if the client does not provide one. By coercing WinRM clients (or capturing traffic from authenticated enterprise vulnerability scanners such as Rapid7 Nexpose), attackers can relay credentials to WinRM over HTTPS to execute remote commands.

### Takeaways - Historical offensive techniques often laid the conceptual groundwork for modern enterprise tools; for example, OWNER presaged BloodHound, and custom Samba challenge-response capture presaged Responder. - Coercing and relaying authentication remains a primary attack vector, progressively shifting from SMB to LDAP, ADCS, and management interfaces like WinRM as older protocols gain enforced signing. - Defensive hardening against WinRM relaying requires configuring group policy to enforce strict Channel Binding Tokens (CBT) rather than leaving it on the default relaxed setting, alongside careful auditing of vulnerability scanner service accounts.