NTLM有Interactive和Noninteractive两种,Interactive就是用户登录类型的,只有client和DC两个参与者,而Noninteractive则是Client要去连接一个Server。在Microsoft NTLM给出了NTLM的Noninteractive验证过程,有如下7步过程:
- (Interactive authentication only) A user accesses a client computer and provides a domain name, user name, and password. The client computes a cryptographic hash of the password and discards the actual password.
- The client sends the user name to the server (in plaintext).
- The server generates a 16-byte random number, called a challenge or nonce, and sends it to the client.
- The client encrypts this challenge with the hash of the user's password and returns the result to the server. This is called the response.
-
The server sends the following three items to the domain controller:
- User name
- Challenge sent to the client
- Response received from the client
- The domain controller uses the user name to retrieve the hash of the user's password from the Security Account Manager database. It uses this password hash to encrypt the challenge.
- The domain controller compares the encrypted challenge it computed (in step 6) to the response computed by the client (in step 4). If they are identical, authentication is successful.
但是其中有些地方不够详细,我在本文中加以补充。NTLM是windows验证的一种,其过程如下图所示: