Pen Test: Pass the Hash

[timothynyc]

"I've got a pentest going for a client and managed to get access to a low-privilege account on the network. I have AD credentials to the low-privilege account and I am attempting to pivot to higher privilege accounts. After doing reconnaisance, I discovered that the AD for backwards compatibility of NTLM Authentication.
I informed the client that this is not ideal as this could be exploited. Theres pros and cons to this as if for some reason Kerberos fails the system can fall back on NTLM. So before making any modifications, he's asked me for a POC that I can indeed exploit the bypassing of kerberos in place while its not failing.
I am attempting to use the pass-the-hash technique to compromise the ntlm hash for the higher privilege accounts. I have configured an html file containing a meta refresh tag (contained in an email), which will redirect the victims browser to a mock SMB server we own. As I've never configured and SMB server myself, would someone be able to explain how to configure the server to force/challenge NTLM authentication when connecting to it?"

[DramaKing]

On 3/6/2024 at 9:37 PM, timothynyc said:

"I've got a pentest going for a client and managed to get access to a low-privilege account on the network. I have AD credentials to the low-privilege account and I am attempting to pivot to higher privilege accounts. After doing reconnaisance, I discovered that the AD for backwards compatibility of NTLM Authentication.
I informed the client that this is not ideal as this could be exploited. Theres pros and cons to this as if for some reason Kerberos fails the system can fall back on NTLM. So before making any modifications, he's asked me for a POC that I can indeed exploit the bypassing of kerberos in place while its not failing.
I am attempting to use the pass-the-hash technique to compromise the ntlm hash for the higher privilege accounts. I have configured an html file containing a meta refresh tag (contained in an email), which will redirect the victims browser to a mock SMB server we own. As I've never configured and SMB server myself, would someone be able to explain how to configure the server to force/challenge NTLM authentication when connecting to it?"

Are you sending the HTML file with the file:/// link as an attachment?