Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DumpNTLMInfo.py] fix error with 2003 #1630

Merged
merged 2 commits into from
Oct 27, 2023
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 10 additions & 11 deletions examples/DumpNTLMInfo.py
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,14 @@
#
# Description:
# Dump remote host information in ntlm authentication model, without credentials.
# For SMB protocols (1/2/3), it's easy to use SMBConnection class (thanks to @agsolino),
# but since negotiate response is not available in original classes,
# For SMB protocols (1/2/3), it's easy to use SMBConnection class (thanks to @agsolino),
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
# but since negotiate response is not available in original classes,
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
# we made out custom classes based on them.
# The usefull information in negotiate response are "Dialect Version", "Signing Options",
# "Maximum bytes allowed per smb request" and "Servers time information".
# The point is sometimes server dosn't include "boot time" in response. But we show it,
# when available, in this script.
#
#
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
# It's very easy to use:
# python DumpNTLMInfo.py 192.168.1.63
#
Expand All @@ -30,7 +30,7 @@
# ToDo:
# [ ] MSSQL
# [ ] Find new protocols using NTLM for authentication in network.
#
#
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved

import os
import sys
Expand Down Expand Up @@ -103,7 +103,7 @@ def _create_bind_request(self):
sec_trailer = SEC_TRAILER()
sec_trailer['auth_type'] = RPC_C_AUTHN_WINNT
sec_trailer['auth_level'] = RPC_C_AUTHN_LEVEL_PKT_INTEGRITY
sec_trailer['auth_ctx_id'] = 0 + 79231
sec_trailer['auth_ctx_id'] = 0 + 79231
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
pad = (4 - (len(packet.get_packet()) % 4)) % 4
if pad != 0:
packet['pduData'] += b'\xFF'*pad
Expand All @@ -115,7 +115,7 @@ def _create_bind_request(self):


class SMB1:
def __init__(self, remote_name, remote_host, my_name=None,
def __init__(self, remote_name, remote_host, my_name=None,
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
sess_port=445, timeout=60, session=None, negSessionResponse=None):
self._uid = 0
self._dialects_data = None
Expand Down Expand Up @@ -272,7 +272,7 @@ def _to_long_filetime(self, dwLowDateTime, dwHighDateTime):


class SMB3:
def __init__(self, remote_name, remote_host, my_name=None,
def __init__(self, remote_name, remote_host, my_name=None,
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
sess_port=445, timeout=60, session=None, negSessionResponse=None):
self._NetBIOSSession = session
self._sequenceWindow = 0
Expand Down Expand Up @@ -427,10 +427,10 @@ def NegotiateSession(self):
packet = self._negotiateSessionWildcard(True, flags1=flags1, flags2=flags2, data=negoData)

if packet[0:1] == b'\xfe':
self._SMBConnection = SMB3(self.hostname, self.target, self._myName, self._sess_port,
self._SMBConnection = SMB3(self.hostname, self.target, self._myName, self._sess_port,
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
self._timeout, session=self._nmbSession, negSessionResponse=SMB2Packet(packet))
else:
self._SMBConnection = SMB1(self.hostname, self.target, self._myName, self._sess_port,
self._SMBConnection = SMB1(self.hostname, self.target, self._myName, self._sess_port,
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved
self._timeout, session=self._nmbSession, negSessionResponse=packet)
return self._SMBConnection.GetNegotiateResponse()

Expand Down Expand Up @@ -503,7 +503,7 @@ def DisplaySmbInfo(self):

negotiation = connection.NegotiateSession()
dialect = negotiation['DialectRevision']
secMode = negotiation['SecurityMode']
secMode = negotiation['SecurityMode'] if 'SecurityMode' in negotiation.fields.keys() else 0
XiaoliChan marked this conversation as resolved.
Show resolved Hide resolved

smb1_enabled = connection.IsSmb1Enabled()

Expand Down Expand Up @@ -661,4 +661,3 @@ def __convert_size(self, size_bytes):
import traceback
traceback.print_exc()
logging.error(str(e))