smb

Documentation

Index

• Variables
• func NewHandler(handlerConfig map[string]string) types.Handler
• type Action
  • func (a Action) String() string
• type AuthInfo
  • func (a AuthInfo) Account() string
  • func (a AuthInfo) HashcatLine() string
• type Event
  • func NewEvent(c net.Conn, action Action, data []byte) *Event
  • func (e *Event) Details() string
  • func (e *Event) Dispatch(cc chan types.InteractionEvent)
  • func (e *Event) FilterString() string
  • func (e *Event) Interaction() *model.Interaction
• type Handler
  • func (h *Handler) Name() string
  • func (h *Handler) Start(app types.App, eventChan chan types.InteractionEvent) error
  • func (h *Handler) Stop(ctx context.Context) error

Variables

var ServerChallenge = []byte{0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}

ServerChallenge is the fixed 8-byte challenge the fake server sends in the NTLMSSP CHALLENGE. It is echoed back into the captured hash so the value must match what a cracker feeds hashcat/john. 0x1122334455667788 is the de-facto convention shared by Responder and Impacket, which lets operators reuse existing tooling and rainbow tables.

Functions

func NewHandler

func NewHandler(handlerConfig map[string]string) types.Handler

Types

type Action

type Action int

const (
	Connect    Action = iota + 1 // 1
	Negotiate                    // 2
	Auth                         // 3
	Disconnect                   // 4
)

func (Action) String

func (a Action) String() string

String - give the type a String function

type AuthInfo

type AuthInfo struct {
	User       string
	Domain     string
	NTResponse []byte // NtChallengeResponse (NTProofStr || client blob)
}

AuthInfo is the useful content extracted from an NTLMSSP AUTHENTICATE.

func (AuthInfo) Account

func (a AuthInfo) Account() string

Account renders DOMAIN\User (or just User when no domain was supplied).

func (AuthInfo) HashcatLine

func (a AuthInfo) HashcatLine() string

HashcatLine formats the captured NetNTLMv2 credential as a hashcat mode 5600 line: user::domain:serverChallenge:NTProofStr:clientBlob.

type Event

type Event struct {
	*types.BaseEvent

	Account string
	// contains filtered or unexported fields
}

Event is an SMB interaction. For Auth events RawData carries the captured NetNTLMv2 hash in hashcat mode 5600 format; Account holds the DOMAIN\User the client authenticated as.

func NewEvent

func NewEvent(c net.Conn, action Action, data []byte) *Event

func (*Event) Details

func (e *Event) Details() string

func (*Event) Dispatch

func (e *Event) Dispatch(cc chan types.InteractionEvent)

Dispatch sends the concrete *Event (not the embedded *BaseEvent) onto the channel so notifiers see this type's Details()/Data().

func (*Event) FilterString

func (e *Event) FilterString() string

FilterString returns "SMB <ACTION> [account] from <ip>", e.g. "SMB Auth CORP\\alice from 10.0.0.5".

func (*Event) Interaction

func (e *Event) Interaction() *model.Interaction

Interaction records the SMB event for the DB / web UI. For Auth events the captured NetNTLMv2 hash (hashcat mode 5600) rides in Data and the DOMAIN\User the client authenticated as rides in RequestTarget.

type Handler

type Handler struct {
	Listener   string
	TargetName string
	// contains filtered or unexported fields
}

Handler is a fake SMB server. It speaks just enough SMB2 to walk a client through NTLM authentication and capture the resulting NetNTLMv2 response as a hashcat-crackable hash. It never grants a session — every authentication attempt is answered with a logon failure once the hash has been recorded.

func (*Handler) Name

func (h *Handler) Name() string

func (*Handler) Start

func (h *Handler) Start(app types.App, eventChan chan types.InteractionEvent) error

func (*Handler) Stop

func (h *Handler) Stop(ctx context.Context) error

Stop mirrors the tcp handler: it closes the listening socket so the accept loop exits, then closes every in-flight connection so blocked reads return and their goroutines exit. Safe to call multiple times and before Start.