SQL NetNTLM Capture

With authorized access to a Microsoft SQL Server instance, execute a UNC-path file or directory procedure such as xp_dirtree or xp_fileexist against an operator-controlled SMB listener. The SQL Server host then attempts outbound NTLM authentication using its service identity, allowing the listener to capture a NetNTLM challenge-response. The captured response is not a plaintext password or the account's NT password hash, and does not establish that offline cracking or relay will succeed.