Windows Authentication: NTLM and Kerberos

Windows uses two primary authentication protocols: NTLM (older, challenge-response) and Kerberos (modern, ticket-based). Understanding both is essential for Active Directory attack and defense.

NTLM works in three messages: Negotiate, Challenge, Authenticate. The client hashes the user's password with the server's random challenge. The hash — not the plaintext — is transmitted.

Because NTLM authenticates with a hash, stealing a hash lets you authenticate without knowing the plaintext password. This is the core of Pass-the-Hash attacks — the hash IS the credential.

Kerberos uses a trusted third party (KDC — Key Distribution Center) to issue tickets. It provides mutual authentication and avoids transmitting credentials over the network after initial TGT issuance.

1. Client sends AS-REQ (encrypted with password hash) to AS. 2. AS returns TGT encrypted with krbtgt key. 3. Client presents TGT to TGS requesting service ticket. 4. Client presents service ticket to the target service.

TGT (Ticket Granting Ticket): proves identity to the KDC, valid ~10 hours. Service Ticket: grants access to a specific service. Both are encrypted with keys the client cannot read.

Kerberos is preferred: supports mutual auth, avoids plaintext transmission, harder to relay. NTLM falls back when Kerberos fails (e.g., IP address access, non-domain hosts) — attackers force NTLM fallback to capture hashes.

NTLM relay intercepts an NTLM authentication attempt and relays it to another service, authenticating as the victim without knowing their password. Responder captures, ntlmrelayx relays.

Pre-authentication requires the client to encrypt a timestamp with their password hash before receiving a TGT. Accounts without pre-auth required are vulnerable to AS-REP Roasting — their TGT can be requested and cracked offline.

Golden ticket: forged TGT signed with the krbtgt hash — grants access to everything. Silver ticket: forged service ticket for a specific service — more stealthy, doesn't touch the KDC.

Disable NTLM where possible, enforce SMB signing to prevent relay, require pre-authentication on all accounts, monitor for unusual ticket requests (Event ID 4768, 4769), and protect the krbtgt account.

What does the Kerberos TGT enable?

NTLM authenticates via hash challenge-response — vulnerable to relay and pass-the-hash. Kerberos uses tickets issued by a trusted KDC — stronger, but vulnerable to Kerberoasting, AS-REP Roasting, and golden/silver ticket attacks when the KDC is compromised. Know both protocols to understand Active Directory attack paths and apply targeted hardening.