Question

During an internal engagement, you capture NTLMv2 authentication attempts using Responder but need to escalate beyond offline cracking, which is too slow given weak-password policy is enforced. You enumerate the domain and identify several hosts where SMB signing is not required. You want to leverage the captured authentication to gain command execution on one of these hosts. What is the MOST effective next step?

Accepted Answer

Configure Responder to disable its SMB and HTTP servers, then use ntlmrelayx.py to relay the incoming authentication to a target host with SMB signing disabled

Answer

Feed the captured NTLMv2 hashes into hashcat with a larger wordlist and rule set to speed up cracking

Answer

Perform a pass-the-hash attack using the NTLMv2 hash directly against the target host with impacket's psexec

Answer

Use the captured hash to request a Kerberos TGT and forge a golden ticket for domain-wide access