Practical Attacks against NTLMv1

#### Executive Summary This technical blog details practical exploitation techniques against environments that allow NTLMv1, describing two attack chains — (1) authentication downgrade to capture/crack NTLMv1 hashes and craft Silver Tickets for privilege escalation and DCSync, and (2) LDAP relay with MIC removal to perform RBCD or Shadow Credentials attacks to impersonate domain accounts and extract NT hashes or perform DCSync; it includes tool commands, prerequisites, and recommends disabling NTLMv1 (enforcing NTLMv2) as the primary mitigation.