Curl: NTLM hash leakage via NTLM authentication

The Microsoft-shipped curl binary (included in Windows 10 and Windows Server 2019 and later) can be leveraged to capture the current user's NTLMv2 challenge-response. When executed with the '--ntlm' flag and an empty user credential specification ('-u :' or '--user :'), the binary passes a NULL identity to the Windows SSPI layer. This triggers a fallback that authenticates using the current user's logon session credentials stored in LSASS without requiring a plaintext password. This artifact can be transmitted to an attacker-controlled listener, facilitating offline cracking or relay attacks.

Impact

Successful exploitation results in the disclosure of an NTLMv2 hash, which can be cracked offline to recover cleartext credentials or used in relay attacks against other internal network resources.

Recommendation

• Deploy the detection rule below to identify suspicious curl invocations.
• Audit environment scripts and automation tasks for the use of 'curl --ntlm -u :' or variants, which are likely candidates for abuse.
• Restrict outbound SMB/HTTP authentication attempts from sensitive workstations to untrusted destinations to limit the feasibility of credential relaying.