NTLM Hash

An NTLM hash (or NT hash) is a 128-bit (16-byte) cryptographic fingerprint. NTLM (NT LAN Manager) is a remnant (still very much present) of the Windows ecosystem. Although Microsoft is now pushing towards Kerberos, NTLM hashing remains central to many network and security operations.

To calculate an NTLM hash: encode the password in UTF-16LE and then apply the MD4 algorithm to this string. The result is a 128-bit hash (32 hexadecimal characters).

A hash cannot be decoded: a hash function like MD4 is designed to be one-way; there is no algorithm that can directly recover the password from its hash.

However, it is possible to use a dictionary attack, which consists of testing a set of likely passwords until one is found that produces the same hash.

Historically, the LAN Manager (LM) hash was the first standard; this older DES-based algorithm is now considered obsolete and extremely vulnerable.

Subsequently, it was superseded by the NTLM hash, which uses MD4 and introduces case sensitivity. While it represents a more secure step than the LM format, it remains vulnerable to modern brute-force and pass-the-hash attacks.

Currently, the standard is Kerberos, a modern protocol that breaks with previous methods by using encrypted tickets. Unlike its predecessors, it establishes mutual authentication and strong encryption, with the critical advantage of never transmitting a hash over the network during the transaction.

NTLM hashes are stored:

— On a local machine: in the SAM file (%SystemRoot%\System32\config\SAM), accessible only with SYSTEM privileges.

— In an Active Directory domain: in the NTDS.dit database on domain controllers, as well as in the memory of the LSASS.exe process.