-
Notifications
You must be signed in to change notification settings - Fork 307
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add NativeOS, NTLM, and GroupName to SMBv1 results #286
Conversation
I think you need to update the zschema as well. @justinbastress or @codyprime correct me if I'm wrong |
Protocol changes look good, but |
@@ -62,7 +65,7 @@ def extended(base, new): | |||
"smb_encryption_support": Boolean(doc="Server supports encryption"), | |||
}, doc="Capabilities flags for the connection. See [MS-SMB2] Sect. 2.2.4."), | |||
'negotiation_log': negotiate_log, | |||
'has_ntlm': Boolean(), | |||
'has_ntlm': Boolean(doc="Server supports the NTLM authentication method"), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There will be cases where ntlm
is populated but has_ntlm
is false, so some clarification is needed
Performs session setup during SMBv1 negotiations to get these fields.
How to Test
I tested this locally against this samba image, with the settings modified to allow SMBv1 (it is disabled by default).
via
./zgrab2 smb --setup-session <<< "127.0.0.1,," | jq
:I also tested against various hosts in the wild, though the results aren't interesting.
Against a host that doesn't support SMBv1 or requires credentials during session setup, these string fields will be empty.
Notes & Caveats
This also includes a small bugfix; in the SMBv1 negotiation, a
ByteCount
field was set to 14 rather than the correct 12.Issue Tracking