NewsPublished 10 Nov 2026

Cracking Server 2022 NTLMv1-SSP Hashes with Rainbow Tables

Source Reddit NetSec

Discussion

Windows Server 2022 environments can be vulnerable to NTLMv1 downgrade attacks if misconfigured to allow NTLMv1 authentication. Attackers can coerce authentication and capture NTLMv1-SSP hashes, which are crackable using rainbow tables due to the lack of Extended Session Security (ESS). This vulnerability arises when the LAN Manager authentication level is set to allow NTLMv1 (levels 0-2). The primary remediation is to enforce NTLMv2-only authentication via Group Policy or registry settings.

r/netsec (opens in a new tab)u/elohhs0 points0 comments

A while back, I had released a blog showing that NTLMv1 downgrade attacks still work on Windows Server 2022! While it isn't a default setting, it's still a misconfiguration to potentially look for.

If a DC’s LmCompatibilityLevel is set to 0-2, you can coerce authentication, strip Extended Session Security (ESS), and obtain an NTLMv1-SSP hash that’s crackable with a rainbow table. :)

Blog: https://hunio.org/security/ntlmv1-ssp-cracking/

Links cited in the discussion

https://hunio.org/security/ntlmv1-ssp-cracking/

Impact

If a Windows Server 2022 domain controller is configured to allow NTLMv1 authentication, attackers can coerce authentication and capture NTLMv1-SSP hashes. These hashes can be cracked with rainbow tables, potentially exposing user or machine NT hashes. This can lead to credential compromise and domain compromise if attackers use the recovered hashes to authenticate as privileged accounts such as the krbtgt account. The impact is significant in environments where NTLMv1 is permitted, but no active exploitation in the wild is reported.

Defensive guidance

The vendor advisory recommends enforcing NTLMv2-only authentication by setting the Group Policy 'Network security: LAN Manager authentication level' to 'Send NTLMv2 response only' or higher. This corresponds to setting the registry key LmCompatibilityLevel to 3 or 5, which disables NTLMv1 and LM authentication. These settings prevent downgrade attacks and rainbow table cracking of NTLMv1 hashes. No other specific mitigations are indicated. Ensure domain controllers and clients are configured accordingly to eliminate NTLMv1 usage.

Summary

This threat involves NTLMv1 downgrade attacks against Windows Server 2022 domain controllers that permit NTLMv1 authentication (LAN Manager authentication level 0-2). Attackers can coerce authentication requests to obtain NTLMv1-SSP hashes without Extended Session Security (ESS), enabling the use of rainbow tables to recover the underlying NT hash. The NT hash is derived from the user's plaintext password and is split into three DES-encrypted ciphertexts in NTLMv1 responses. ESS, when enabled, prevents rainbow table attacks by introducing client-generated challenges, but it can be disabled or negotiated away, allowing downgrade attacks. Tools like Responder and PetitPotam can be used to perform these attacks. The vulnerability is due to misconfiguration rather than a flaw in Windows Server 2022 itself.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 10 Nov 2026, 20:03 UTC

Technical details

References

Community reviews

Related threats