NetExec has a new Module: Timeroast🔥
In AD environments, the DC hashes NTP responses with the computer account NT hash. That means that you can request and brute force all computer accounts in a domain from an UNAUTHENTICATED perspective!
Implemented by @Disgame_
1/3🧵
In AD environments, the DC hashes NTP responses with the computer account NT hash. That means that you can request and brute force all computer accounts in a domain from an UNAUTHENTICATED perspective!
Implemented by @Disgame_
1/3🧵
In detail:
To prevent attackers from tampering with the system clock, the DC generates a MAC to authenticate NTP responses. The MAC has the form MD5(MD4(computer-pwd) || NTP-response), where the NTP-response acts as a salt. This hash can then be cracked using hashcat.
2/3🧵
To prevent attackers from tampering with the system clock, the DC generates a MAC to authenticate NTP responses. The MAC has the form MD5(MD4(computer-pwd) || NTP-response), where the NTP-response acts as a salt. This hash can then be cracked using hashcat.
2/3🧵
If you want to learn more, I highly recommend the white paper from @SecuraBV: secura.com/uploads/whitep…
And the original implementation they did at: github.com/SecuraBV/Timer…
3/3🧵
And the original implementation they did at: github.com/SecuraBV/Timer…
3/3🧵
• • •
Missing some Tweet in this thread? You can try to
force a refresh
