NetNTLMv1 Relay / Hash Cracking

Use MS-EFSRPC (PetitPotam) to induce a Windows host to authenticate to an operator-controlled Responder listener, capture the resulting NTLM challenge-response, and attempt offline recovery only when the response is NetNTLMv1. The negotiated response may instead be NTLMv2, depending on client policy and configuration. This procedure captures authentication material; it does not relay authentication to another service. Offline password cracking is a separate T1110.002 activity.