The SMBNT module tests accounts against the Microsoft netbios-ssn (TCP/139) and microsoft-ds (TCP/445) services. Besides testing normal passwords, this module allows Medusa to directly test NTLM hashes against a Windows host. This may be useful for an auditor who has aquired a sam._ or pwdump file and would like to quickly determine which are valid entries.
Several "-m 'METHOD:VALUE'" options can be used with this module. The
following are valid methods: GROUP, GROUP_OTHER, PASS and NETBIOS.
The following values are useful for these methods:
Method | Value | Description |
GROUP | LOCAL* | Check local account. |
DOMAIN | Check credentials against this hosts primary domain controller via this host. | |
BOTH | Check both. This leaves the workgroup field set blank and then attempts to check the credentials against the host. If the account does not exist locally on the host being tested, that host then queries its domain controller. | |
GROUP_OTHER | [user specified] | Configure arbitrary domain for host to authenticate against. |
PASS | PASSWORD* | Use a normal password. |
HASH | Use a NTLM hash rather than a password. | |
MACHINE | Use the Machine's NetBIOS name as the password. | |
NETBIOS | Force NetBIOS Mode (Disable Native Win2000 Mode) |
The following examples demonstrate several uses of the SMBNT module:
% medusa -h 192.168.0.20 -u administrator -e ns -M smbnt -m NETBIOS -n 139
Medusa v1.0-rc1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: (1/2)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: administrator (2/2)
% medusa -h 192.168.0.20 -u foo -p bar -M smbnt -m GROUP_OTHER:FOODOM
Medusa v1.0-rc1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: foo (1/1) Password: bar (1/1)
% medusa -H hosts.txt -C pwdump.txt -M smbnt -m PASS:HASH
Medusa v1.0-rc1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/10) User: Administrator (1/3) Password: 92D887C8010492C2944E2DF489A880E4:7A2EDE4F51BC5A03984C6BA2C239CF63::: (1/1)
ACCOUNT FOUND: [smbnt] Host: 192.168.0.20 User: Administrator Password: 92D887C8010492C2944E2DF489A880E4:7A2EDE4F51BC5A03984C6BA2C239CF63::: [SUCCESS]
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/10) User: bar (2/3) Password: 49D58563113416EBAAD3B435B51404EE:AA3AFE73B6E0C2D87B3A428BF696AE71::: (1/1)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/10) User: foo (3/3) Password: 92D887C8010492C2944E2DF489A880E4:7A2EDE4F51BC5A03984C6BA2C239CF63::: (1/1)
ACCOUNT FOUND: [smbnt] Host: 192.168.0.20 User: foo Password: 92D887C8010492C2944E2DF489A880E4:7A2EDE4F51BC5A03984C6BA2C239CF63::: [SUCCESS]
< snip >
It should be noted that once a valid hash is located, it is often not necessary
to "crack" the password in order to use it. Using a modified SAMBA client, the
hash can just be "passed" directly. See
this page for a SAMBA patch and several examples.
Be careful of mass domain account lockout with this module. For example, assume you are checking several accounts against many domain workstations. If you are using either the "GROUP:DOMAIN" or the "GROUP:BOTH" option and these accounts do not exist locally on the workstations, each workstation will in turn check their respective domain controller. This could cause a bunch of lockouts. Of course, it'd look like the workstations, not you, were doing it. ;)
FYI, this code is unable to test accounts on default XP hosts which are not part
of a domain and do not have normal file sharing enabled. Default XP does not allow
shares and returns STATUS_LOGON_FAILED for both valid and invalid credentials. XP
with simple sharing enabled returns SUCCESS for both valid and invalid credentials.
If anyone knows a way to test in these configurations...
Medusa Documentation