Rapid7 Vulnerability & Exploit Database

Authentication Capture: SMB

Back to Search

Authentication Capture: SMB

Created
05/30/2018

Description

This module provides a SMB service that can be used to capture the challenge-response password NTLMv1 & NTLMv2 hashes used with SMB1, SMB2, or SMB3 client systems. Responses sent by this service by default use a random 8 byte challenge string. A specific value (such as `1122334455667788`) can be set using the CHALLENGE option, allowing for easy cracking using Cain & Abel (NTLMv1) or John the Ripper (with jumbo patch). To exploit this, the target system must try to authenticate to this module. One way to force an SMB authentication attempt is by embedding a UNC path (\\SERVER\SHARE) into a web page or email message. When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate. Another option is using auxiliary/spoof/{nbns,llmnr} to respond to queries for names the victim is already looking for. Documentation of the above spoofing methods can be found by running `info -d`.

Author(s)

  • hdm <x@hdm.io>
  • Spencer McIntyre
  • agalway-r7
  • sjanusz-r7

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/server/capture/smb
msf auxiliary(smb) > show actions
    ...actions...
msf auxiliary(smb) > set ACTION < action-name >
msf auxiliary(smb) > show options
    ...show and set options...
msf auxiliary(smb) > run

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;