Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Into The Rainbow: Google’s NTLMv1 Rainbow Tables Explained in a Bit Too Much Detail
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: Google published a blog post with accompanying rainbow tables targeting the Data Encryption Standard (DES) key space. The tables enable recovery of the NT hash used to generate the ciphertexts in NTLMv1 responses. We’ll dive into the tables, the recovery process, and ideally demystify any lingering questions.
Acknowledgements
There are many previous works on the subject, such as;
1. Nic Losby, his blog post, and the amazing work he has led over the past few years to generate the tables
2. Joe Testa and the rainbowcrackalack project, which inspired a lot of work within this blog
3. David Hulton and Moxie Marlinspike and their DEFCON 20 talk, shedding light on the weaknesses of MS-CHAPv2
4. Philippe Oechslin, who produced the original white paper on rainbow tables
5. Anyone I’ve worked with and collaborated with along the way
The Terms
For a deep dive into all things NTLM, please review this white paper by Elad Shamir. In this blog, I assume the reader understands the differences between NTLMv1 and NTLMv2 and the concept of an NT hash. Any time the term “NTLMv1 response” is used, I’m referring to the ciphertexts generated by the client during the “Authenticate” message. When the term “DES key” is used, we’re referring to one of three 7-byte keys, derived from the NT hash, used to encrypt the static challenge of 1122334455667788.
Introduction
NTLMv1 is a legacy authentication protocol that uses a cryptographically weak encryption algorithm, permitting operators to recover the NT hash used to generate the NTLMv1 response. Historically, operators obtained …