Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add NativeOS, NTLM, and GroupName to SMBv1 results #286

Merged
merged 6 commits into from Mar 15, 2021
Merged

Add NativeOS, NTLM, and GroupName to SMBv1 results #286

merged 6 commits into from Mar 15, 2021

Conversation

ghost
Copy link

@ghost ghost commented Dec 10, 2020

Performs session setup during SMBv1 negotiations to get these fields.

How to Test

I tested this locally against this samba image, with the settings modified to allow SMBv1 (it is disabled by default).

via ./zgrab2 smb --setup-session <<< "127.0.0.1,," | jq:

{
  "ip": "x.x.x.x",
  "data": {
    "smb": {
      "status": "success",
      "protocol": "smb",
      "result": {
        "smbv1_support": true,
        "smb_version": {
          "major": 1,
          "minor": 0,
          "revision": 0,
          "version_string": "SMB 1.0"
        },
        "os_name": "Unix",
        "ntlm": "Samba 3.0.37",
        "group_name": "WORKGROUP",
        "has_ntlm": false
      },
      "timestamp": "2020-12-10T16:20:08Z"
    }
  }
}

I also tested against various hosts in the wild, though the results aren't interesting.

Against a host that doesn't support SMBv1 or requires credentials during session setup, these string fields will be empty.

Notes & Caveats

This also includes a small bugfix; in the SMBv1 negotiation, a ByteCount field was set to 14 rather than the correct 12.

Issue Tracking

lib/smb/smb/smb.go Outdated Show resolved Hide resolved
@bwireman
Copy link
Contributor

bwireman commented Jan 7, 2021

I think you need to update the zschema as well. @justinbastress or @codyprime correct me if I'm wrong

@codyprime
Copy link
Member

Protocol changes look good, but zgrab2_schemas/zgrab2/smb.py needs to be updated with the new fields.

lib/smb/smb/zgrab.go Outdated Show resolved Hide resolved
@@ -62,7 +65,7 @@ def extended(base, new):
"smb_encryption_support": Boolean(doc="Server supports encryption"),
}, doc="Capabilities flags for the connection. See [MS-SMB2] Sect. 2.2.4."),
'negotiation_log': negotiate_log,
'has_ntlm': Boolean(),
'has_ntlm': Boolean(doc="Server supports the NTLM authentication method"),
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There will be cases where ntlm is populated but has_ntlm is false, so some clarification is needed

@codyprime codyprime merged commit 17a5257 into zmap:master Mar 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants