NMB Auto Responding and SMB Fixed Challenges

03/19/2007


I know this has been discussed before, but I thought I'd post my own implementation anyways. The patch linked below modifies Samba to respond to all broadcast NetBIOS name requests and uses a fixed challenge for LM/NTLM authentication. All sorts of fun can be had by running this on an internal network or combining it with Karma. The current challenge works with Cain & Abel and the various Rainbow Tables floating around.

Patch [Samba 3.4.5] w/ hash passing goodness
Patch [Samba 3.0.37]
Example smb.conf
John the Ripper Patch for NetNTLMv2 (against 1.7.3.4 w/ Jumbo-2 patch - includes NetLM/NetNTLM/NetLMv2)
* Visit the OpenWall site for the "Jumbo" patches - Official John Site.
RainbowCrack Patch for NetLM/NetNTLM/NetHalfLM
Helper script for using HalfLM cracked portion of password as seed to John.