Skip to content
This repository has been archived by the owner on Dec 6, 2023. It is now read-only.

Module to check for NTLMv1 Compatibility #640

Merged
merged 2 commits into from Oct 13, 2022

Conversation

Tw1sm
Copy link
Contributor

@Tw1sm Tw1sm commented Sep 15, 2022

Added a small module to query the target's LmCompatibilityLevel to determine if the target allows NTLMv1 auth.

Example:
image

This check queries the registry which requires admin privileges - makes it more ideal for auditing systems that still allow NTLMv1 than locating boxes you can laterally move to (unfortunately)

@SAERXCIT
Copy link

Great idea ! However from what I understand NTLMv1 is also enabled if LmCompatibilityLevel is set to 2.

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level

@Tw1sm
Copy link
Contributor Author

Tw1sm commented Sep 16, 2022

Great idea ! However from what I understand NTLMv1 is also enabled if LmCompatibilityLevel is set to 2.

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level

Great catch, modified to include level 2

@mpgn mpgn added enhancement module all good tested in my lab and removed module labels Sep 18, 2022
@mpgn
Copy link
Contributor

mpgn commented Sep 23, 2022

thanks for the module :) Tested in my lab, all good for me I will merge it probably next week.
thanks @SAERXCIT for the review !

@mpgn mpgn merged commit d162d7b into byt3bl33d3r:master Oct 13, 2022
@0xAsh
Copy link

0xAsh commented Oct 20, 2022

This is so cool and something I've been wanting for a looong time but never tried to implement myself. Thank you @Tw1sm !

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
all good tested in my lab enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants