NTLM Challenge

CHALLENGE_MESSAGE

The server sends a random challenge and its own names, and still no secret travels.

  • NTLM
  • File server to client
  • SMB, port 445

Why It Matters

The client's answer is computed over this challenge, so whoever picks it, or passes it on, decides where that answer will work. NTLM never proves the server, which is why a machine in the middle can sit here.

Where It Sits

The strip shows every step of the NTLM sign-in, with this page's step marked. Each of the others links to its own page, and Step Through It opens the walk-through on the topic page.

NTLMStep Through It
  1. Step 1 of 6, Negotiate, ws-017 to srv-fin-01
  2. Step 2 of 6, Challenge, srv-fin-01 to ws-017
  3. Step 3 of 6, Authenticate, ws-017 to srv-fin-01
  4. Step 4 of 6, Pass-Through, srv-fin-01 to dc-01
  5. Step 5 of 6, DC Answer, dc-01 to srv-fin-01
  6. Step 6 of 6, Access, srv-fin-01 to ws-017

What Happens

srv-fin-01 replies with a CHALLENGE_MESSAGE that holds an 8-byte random challenge, the options it chose from ws-017's list, and target information. The target information is a list of attribute and value pairs (AV pairs) naming the server, its domain and its forest, with the server's current time.

Nothing in it is secret, and nothing in it proves the server is genuine, because NTLM has no server authentication. A client cannot tell srv-fin-01 from a machine answering in its place.

The answer that follows is computed over this challenge. A machine in the middle can hand the victim a real server's challenge, so the answer works on that server. A machine posing as the server sends a challenge of its own and keeps the answer to guess against offline.

The defences come with the answer. A server that requires signing, or that checks the server name or channel binding inside the answer, leaves a passed-on answer of no use to the machine in the middle.

Nothing is logged for the challenge itself. When the exchange finishes, the server records it in its Microsoft-Windows-NTLM/Operational log as enhanced NTLM event 4022, or 4023 when it was weaker. That event holds the negotiated flags, the NTLM version and whether a message integrity code (MIC) protected the messages.

What Is Sent

Each part of the message is listed with what it holds and what protects it. A part sealed with a key can be read only by whoever holds that key, and a part marked In the clear has no protection of its own.

PartWhat It HoldsProtection and Who Can Read It
The challenge ServerChallengeA random 64-bit number that the answer must be built from.In the clearAnyone who sees the traffic can read it.
Target information TargetInfosrv-fin-01's NetBIOS and DNS names, its domain's names and its clock time.In the clearAnyone who sees the traffic can read it.
The options it chose NegotiateFlagsIts picks from ws-017's offer. The signing flag must come back if ws-017 set it.In the clearAnyone who sees the traffic can read it.

What the Target Information Can Carry

The target information is where the server describes itself, and where the client later adds the name of the server it meant to reach. These are the pairs it can carry, by the names the protocol gives them.

AV PairWhat It Holds
MsvAvNbComputerName, MsvAvDnsComputerNameThe server's NetBIOS and DNS names
MsvAvNbDomainName, MsvAvDnsDomainNameIts domain's NetBIOS and DNS names
MsvAvDnsTreeNameIts forest
MsvAvTimestampThe server's current time
MsvAvFlagsConfiguration flags, which in the client's copy say whether a MIC is included
MsvAvTargetNameThe service principal name (SPN) of the server the client meant to reach, added by the client
MsvAvChannelBindingsA hash of the channel, such as TLS, or all zeros when there is none, added by the client

What Is Logged

Nothing is logged for this message on its own. The client's event 4020, in its Microsoft-Windows-NTLM/Operational log where enhanced NTLM logging runs, records the sign-in as a whole.

Attacks That Hook in Here

These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.

  • NTLM Relay

    Passes a victim's NTLM sign-in to another server and keeps the session it opens.

    At This Step The machine in the middle hands the real server's challenge to the victim, so the answer that comes back is one that server will accept.

  • LLMNR, NBT-NS and mDNS Poisoning

    Answers the local network's name queries so victims sign in to the wrong machine.

    At This Step The fake server sends a challenge of its own. The answer built from it can be guessed against offline to find a weak password.

  • NTLMv1 Downgrade

    Gets a weak NTLMv1 response from a client still allowed to send one, then the NT hash.

    At This Step Where a client may still send NTLMv1, the old version, its answer to this challenge can come back in that weak form.

Sources