NTLMv1 reversion to NTLM with hashcat and the NTLMv1-multi tool

The talk explains why NTLMv1 remains a risk in Windows environments even though it is considered legacy. The speaker starts with background on how Windows stores passwords as NT hashes, how LM and NTLM variants differ, and how the NTLMv1 challenge-response exchange works at a high level. The key detail for the attack is that, without extended session security, the response can be split into DES keys, and those keys can be recovered with GPU-based cracking instead of rainbow tables.

The exploitation path combines Responder, which listens for and captures authentication attempts, with Coercer, which forces a domain controller to authenticate to the attacker. The captured response is reformatted by a helper script called NTLMv1-multi so Hashcat can crack it in mode 14000. The speaker estimates cloud GPU cost and time against a typical penetration test window, then shows the cracked DES keys being converted back into an NT hash and used with netexec to run a DCSync.

The takeaway is that a domain whose LAN Manager compatibility level is two or lower exposes NTLMv1 and should be treated as compromised. Mitigations discussed include raising that compatibility level, which is a separate policy from the regular domain policy and is often left at old settings on domain controllers, and making sure vulnerability scanners do not spray credentials in NTLMv1 format.