7MS #676: Tales of Pentest Pwnage – Part 72

·1 hr·5 clips

Why did Brian's pen test box capture a domain controller's downgraded NTLMv1 hash without active poisoning?

In episode 676 of 7 Minute Security, host Brian Johnson narrates a penetration test story focused on internal network assessment. He begins by setting up a low-privilege account on the internal network to simulate an attacker's foothold. Brian runs initial reconnaissance tools like PingCastle and Responder in analyze mode to capture network traffic. He discovers an NTLMv1 SSP hash from a domain controller in his responder logs, which surprises him because he didn't actively poison anything. Investigating further, he finds that the default responder.conf file in his Xeagle toolkit had a static challenge value set, enabling the capture. This hash indicates a weak LAN Manager authentication setting in the domain's default domain controller policy, a common legacy issue. Brian uses the NTLMv1 tool to process the hash and then leverages vast.ai with NVIDIA GPUs to crack it, costing about $2.50 per hour and completing in 20 hours. After assembling the cracked components, he gains the ability to request a Ticket-Granting Ticket (TGT) as the domain controller, simulating full domain compromise. He reflects on how this attack might evade detection by many security tools like XDR or MDR until late in the kill chain. Brian emphasizes the value of penetration testing for uncovering such legacy misconfigurations. The episode includes sponsor messages for safepass.me, a password compliance tool, and personal tangents about a 7MS club meeting, a conference rejection, a trip with his son, and a TMJ treatment update.

As heard by us

A practical pen-test story built around password hygiene and weak-password auditing.

The episode leans into a pen-test pwnage story while keeping its eye on practical password control. Brian Johnson opens with a joke about getting pwned by noon and then by tonight, which sets a clear tone: the basics still matter.

Read the full review in PlayNext →

Why you'd press play

When weak passwords are the door, this one shows you where the latch actually is.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from 7 Minute Security