{"action":"created","issue":{"url":"https://api.github.com/repos/CoreSecurity/impacket/issues/102","labels_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/102/labels{/name}","comments_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/102/comments","events_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/102/events","html_url":"https://github.com/CoreSecurity/impacket/issues/102","id":113724385,"number":102,"title":"NTLM hash compromise security issue","user":{"login":"scriptjunkie","id":1174495,"avatar_url":"https://avatars.githubusercontent.com/u/1174495?v=3","gravatar_id":"","url":"https://api.github.com/users/scriptjunkie","html_url":"https://github.com/scriptjunkie","followers_url":"https://api.github.com/users/scriptjunkie/followers","following_url":"https://api.github.com/users/scriptjunkie/following{/other_user}","gists_url":"https://api.github.com/users/scriptjunkie/gists{/gist_id}","starred_url":"https://api.github.com/users/scriptjunkie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scriptjunkie/subscriptions","organizations_url":"https://api.github.com/users/scriptjunkie/orgs","repos_url":"https://api.github.com/users/scriptjunkie/repos","events_url":"https://api.github.com/users/scriptjunkie/events{/privacy}","received_events_url":"https://api.github.com/users/scriptjunkie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-28T01:36:30Z","updated_at":"2015-10-29T13:50:19Z","closed_at":null,"body":"Impacket will gladly negotiate NTLMv1, from which the hash can be recovered with 100% certainty from network traffic alone in < 48 hours via chapcrack (NTLMv1) \r\n(see: http://markgamache.blogspot.com/2013/01/ntlm-challenge-response-is-100-broken.html) \r\nThis would be very bad, as any system you authenticated to with Impacket, if it was compromised, could have simply sent an NTLMv1 challenge, sniffed traffic while you authenticated, then could recover the hash used, and likely take over the rest of the network, regardless of how strong the account’s password is. Impacket needs to either disable NTLMv1 by default, or support a minimum NTLM version configuration setting or parameter allowing the user to block NTLMv1. I verified testing some of the standard scripts against earlier versions of Windows, and it gladly complied.\r\n\r\nIt's worth noting that \"NTLM 2 has been available for Windows NT 4.0 since Service Pack 4 (SP4) was released\" https://support.microsoft.com/en-us/kb/239869 which is so far back, much of impacket won't work anyway. It's just incredibly unlikely that a user of this library will ever need NTLMv1, and it poses a major risk if enabled by default."},"comment":{"url":"https://api.github.com/repos/CoreSecurity/impacket/issues/comments/152184458","html_url":"https://github.com/CoreSecurity/impacket/issues/102#issuecomment-152184458","issue_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/102","id":152184458,"user":{"login":"asolino","id":11577828,"avatar_url":"https://avatars.githubusercontent.com/u/11577828?v=3","gravatar_id":"","url":"https://api.github.com/users/asolino","html_url":"https://github.com/asolino","followers_url":"https://api.github.com/users/asolino/followers","following_url":"https://api.github.com/users/asolino/following{/other_user}","gists_url":"https://api.github.com/users/asolino/gists{/gist_id}","starred_url":"https://api.github.com/users/asolino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asolino/subscriptions","organizations_url":"https://api.github.com/users/asolino/orgs","repos_url":"https://api.github.com/users/asolino/repos","events_url":"https://api.github.com/users/asolino/events{/privacy}","received_events_url":"https://api.github.com/users/asolino/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T13:50:19Z","updated_at":"2015-10-29T13:50:19Z","body":"Just merged your PR plus added some stuff. Please recheck the original issue and close this ticket if solved."}}