{"version":"1.0","provider_name":"MacroSEC","provider_url":"https:\/\/macrosec.tech","title":"Capturing NetNTLM V2 hashes Via Outlook Signatures &#8212; MacroSEC","type":"rich","width":600,"height":338,"html":"<blockquote class=\"wp-embedded-content\" data-secret=\"u6ltFm75Os\"><a href=\"https:\/\/macrosec.tech\/index.php\/2021\/05\/17\/capturing-netntlm-v2-hahes-via-outlook-signatures\/\">Capturing NetNTLM V2 hashes Via Outlook Signatures<\/a><\/blockquote><iframe sandbox=\"allow-scripts\" security=\"restricted\" src=\"https:\/\/macrosec.tech\/index.php\/2021\/05\/17\/capturing-netntlm-v2-hahes-via-outlook-signatures\/embed\/#?secret=u6ltFm75Os\" width=\"600\" height=\"338\" title=\"&#8220;Capturing NetNTLM V2 hashes Via Outlook Signatures&#8221; &#8212; MacroSEC\" data-secret=\"u6ltFm75Os\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" class=\"wp-embedded-content\"><\/iframe><script>\n\/*! This file is auto-generated *\/\n!function(d,l){\"use strict\";l.querySelector&&d.addEventListener&&\"undefined\"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!\/[^a-zA-Z0-9]\/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret=\"'+t.secret+'\"]'),o=l.querySelectorAll('blockquote[data-secret=\"'+t.secret+'\"]'),c=new RegExp(\"^https?:$\",\"i\"),i=0;i<o.length;i++)o[i].style.display=\"none\";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute(\"style\"),\"height\"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):\"link\"===t.message&&(r=new URL(s.getAttribute(\"src\")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener(\"message\",d.wp.receiveEmbedMessage,!1),l.addEventListener(\"DOMContentLoaded\",function(){for(var e,t,s=l.querySelectorAll(\"iframe.wp-embedded-content\"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute(\"data-secret\"))||(t=Math.random().toString(36).substring(2,12),e.src+=\"#?secret=\"+t,e.setAttribute(\"data-secret\",t)),e.contentWindow.postMessage({message:\"ready\",secret:t},\"*\")},!1)))}(window,document);\n\/\/# sourceURL=https:\/\/macrosec.tech\/wp-includes\/js\/wp-embed.min.js\n<\/script>\n","thumbnail_url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/05\/3811384_edited.jpg","thumbnail_width":400,"thumbnail_height":400,"description":"Today, it is possible to craft a malicious email that allows an adversary to capture NetNTLMV2 hashes without requiring any form of interaction with the user. The user only has to click open the email and the hashes will be captured. Capturing NetNTLM hashes from network communications is nothing new. There are several ways of doing this. The most common way is via SBM. SMB is a protocol for file sharing purposes, and we can force SMB communications to an attacker using tools to capture the authentication attempt and extract the password hash. Sniffing SMB traffic requires elevated permissions that typically are not available when you first get command and control and therefore sometimes it can a little difficult to get the hash. Furthermore, it can be a noisy when we are sniffing SMB Traffic and therefore this may impact the user experience or even create suspicion to a user. In this blog, I will explain the concept of Windows \u2018Trust Zones\u2019, how email signatures are configured in Outlook and how the combination of the two can result in the capture of hashes with minimal impact to the user experience through http. I will show both the methods, the first with SMB and then with HTTP."}