IT:AD:NTLM

• (UP)
• Decrypted: http://davenport.sourceforge.net/ntlm.html

## How it works ##

• User requests access to client computer.

  • User provides user credentials.
  • The client computer caches the password hash and discards the password.

  * The client computer sends a request to the server, which includes the user name, with request in plain text.

  • The server generates a 16-byte random number called challenge, or nonce, and sends it to the client.
• Client sends response message.

  • The client uses a password hash generated from the user's password to encrypt the challenge sent by the server.
  • It sends this encrypted challenge in the form of a response back to the server.

  * Server sends challenge and response to domain controller.

  • The server sends the user name, the original challenge, and the response from the client computer to the domain controller.

  * Domain controller compares challenge and response to authenticate user.

  • The domain controller obtains the password hash for the user, and then uses this hash to encrypt the original challenge.
  • Next, the domain controller compares the encrypted challenge with the response from the client computer.
  • If they match, the domain controller sends the server confirmation that the user is authenticated.

  * Server sends response to the client. Assuming valid credentials, the server grants the client access to the requested service or resource.