3 ms·

Misleading title, Zoom doesn't divulge the password hash, but also doesn't prevent users from clicking on UNCs. Having fallen out of paying attention to Window

by sk5t 7y ago

Misleading title, Zoom doesn't divulge the password hash, but also doesn't prevent users from clicking on UNCs. Having fallen out of paying attention to Windows Server over the past few years, I'd be a little surprised if the weak NTLM hash is still on by default in current versions of Windows (although that's not to say most of the Windows install base isn't in obsolescence).

microcolonel 7y ago
> I'd be a little surprised if the weak NTLM hash is still on by default in current versions of Windows Even if it didn't, which I'm not sure about, they still need to send one if you're trying to open a samba share. This attack works by presenting a UNC link to a samba share, which (when the user accepts the credential prompt) will send a nice compatible NTLM password hash.