I am recently on a wireless network security assessment task for a enterprise client. They didn't apply the WPA-PEAP-MSCHAPv2 user authentication configuration correctly (stations don't validate the servers' identity) and I successfully intercepted the NETNTLM string by Evil Twin attack, cracked the string, got the NT hash and managed to join their wireless network from Kali Linux using the wpa-supplicant tool with the hash.

However, for reasons I don't know or understand, the client's IT manager insists it's not adequate PoC if I can only show him the evidence that Kali joined their network and asked me to show him that I got my Windows laptop into their network.

I did a lot of Googling trying to find out how to let Windows machine joining a wireless network only use the NT hash instead of the plaintext password but cannot find anything helpful. So I wonder if this is viable at all or I am just stuck on some questions too naive to be given an answer?

Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.