SMB NTLMv1 Login Request Corruption

This module sends a series of SMB login requests using the NTLMv1 protocol with corrupted bytes.

Search Other Modules

Rank

Normal

Authors

hdm < hdm [at] metasploit.com >

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt
msf auxiliary(smb_ntlm1_login_corrupt) > set RHOST [TARGET IP]
msf auxiliary(smb_ntlm1_login_corrupt) > run

Module Options

MAXDEPTH	Specify a maximum byte depth to test
RHOST	The target address
RPORT	The target port (default: 445)
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
FuzzChar	Sets the character to use for generating long strings
FuzzTracer	Sets the magic string to embed into fuzzer string inputs
NTLM::SendLM	Always send the LANMAN response (except when NTLMv2_session is specified)
NTLM::SendNTLM	Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
NTLM::SendSPN	Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required
NTLM::UseLMKey	Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent
NTLM::UseNTLM2_session	Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
NTLM::UseNTLMv2	Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
Proxies	Use a proxy chain
SMB::ChunkSize	The chunk size for SMB segments, bigger values will increase speed but break NT 4.0 and SMB signing
SMB::Native_LM	The Native LM to send during authentication
SMB::Native_OS	The Native OS to send during authentication
SMB::VerifySignature	Enforces client-side verification of server response signatures
SMBDirect	The target port is a raw SMB service (not NetBIOS)
SMBDomain	The Windows domain to use for authentication
SMBName	The NetBIOS hostname (required for port 139 connections)
SMBPass	The password for the specified username
SMBUser	The username to authenticate as
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
VERBOSE	Enable detailed status messages
WORKSPACE	Specify the workspace for this module
SMB::obscure_trans_pipe_level	Obscure PIPE string in TransNamedPipe (level 0-3)
SMB::pad_data_level	Place extra padding between headers and data (level 0-3)
SMB::pad_file_level	Obscure path names used in open/create (level 0-3)
SMB::pipe_evasion	Enable segmented read/writes for SMB Pipes
SMB::pipe_read_max_size	Maximum buffer size for pipe reads
SMB::pipe_read_min_size	Minimum buffer size for pipe reads
SMB::pipe_write_max_size	Maximum buffer size for pipe writes
SMB::pipe_write_min_size	Minimum buffer size for pipe writes
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)