Challenge

Ça vient et ça s’en va. Apparemment le hash de l’Administrateur a été compromis lors d’une attaque, on aurait bien besoin d’un petit peu d’aide pour comprendre quelle est l’attaque qui a été utilisée. Vous savez, on n’est plus tout jeune…

Mais, nous savons que c’est une attaque de NTLM Relay.

Retrouvez la CVE utilisée par l’attaquant, l’id des paquets des deux challenges qui ont permis l’attaque et enfin, le challenge lui-même !

Network forensics at P’Hack 2026. We get a PCAP and one clue: the Administrator hash was compromised via an NTLM relay attack. Flag format is AMSI{CVE-XXXX-XXXXX_<ID1>_<ID2>_<CHALLENGE EN HEX>}. Find the CVE, the two packet IDs, and the NTLM challenge nonce.

CVE

We open the PCAP in Wireshark. The challenge already tells us it’s an NTLM relay attack, so we search for recent CVEs related to NTLM relay and land on CVE-2025-33073.

The relay handshake

NTLM relay runs two NTLM handshakes at the same time. The attacker coerces the victim into authenticating to their listener, then simultaneously forwards every NTLM message to the real target. The victim’s signed response ends up being valid against the real server.

Filtering on ntlmssp, two handshakes appear running in parallel. Packets 103 and 104 are the two NTLM NEGOTIATE (Type 1) messages, one on each leg of the relay:

103  192.168.78.129:49714 → 192.168.78.130:445   NTLMSSP NEGOTIATE
104  192.168.78.130:59170 → 192.168.78.129:445   NTLMSSP NEGOTIATE

The nonce

The NTLM CHALLENGE (Type 2) responses come in packets 105 and 106. The real server sends an 8-byte nonce that the client must use to build its response. The attacker grabs it and forwards it to the victim. When the victim responds, that response is valid against the real server. Both sides carry the same nonce:

094e22edbd3995d2

Assembling the three pieces into the flag format. GG WP.