In September 2004, there was a thread that included rainbow cracking of NTLMv2
==========================================
1)"There is a plug-in for Rainbow Crack that allows you to make NTLMv2 hash tables"
How is this possible, since NTLMv2 makes use of challenge code and user/workgroupname to calculate the passwordhash?
==========================================
I was wondering if anyone knows the answer on this last question: how is creating rainbow tables possible, when the hash not only depends on the password, but also on variables such as the username and domain.
Another question:
Does anyone here knows if NTLMv2 hashes are stored in the Windows registry / SAM and retrievable with local admin privileges? They only storage items I know are LM and NTLM. Since NTLMv2 depends on the NTLM hash as well, I was starting to think that maybe the NTLMv2 hash is generated on the fly upon an authentication request from a client and is only used for safe network transportation. But as this is just guesswork: anyone here knows how this works???
Maarten
