SMB

SMB Handler (NetNTLMv2 capture)

In development feature

This feature is in development. Please help make it awesome by providing feedback on your experience using it.

Purpose

A fake SMB server for authorized engagements. It speaks just enough SMB2 to walk a client through NTLM authentication and capture the resulting NetNTLMv2 response as a hashcat-crackable hash. Point a target at \\your-host\share (via a coerced UNC path, img src=file://…, RESPONDER-style poisoning, an SSRF, etc.) and, if it authenticates, you get its hash.

It never grants a session — every authentication attempt is answered with a logon failure once the hash has been recorded. No credentials are verified and no shares are served.

Behaviour

Listens on tcp4 at the configured listener address (SMB direct-host, default :445).
Answers a legacy SMB1 multi-protocol negotiate with an SMB2 wildcard so the client re-negotiates over SMB2; answers SMB2 NEGOTIATE with dialect 2.1 and a SPNEGO token advertising NTLMSSP.
On SESSION_SETUP, returns an NTLMSSP CHALLENGE with the fixed server challenge 0x1122334455667788 (the Responder/Impacket convention, so captured hashes work with existing tooling).
Parses the client’s NTLMSSP AUTHENTICATE, extracts the domain, user and NT challenge response, and emits an Auth event whose Data() is the hashcat mode 5600 line:
```
user::domain:1122334455667788:<NTProofStr>:<clientBlob>
```
Answers the authenticate with STATUS_LOGON_FAILURE and closes.

Configuration

Key	Required	Default	Notes
`handler`	yes	—	Must be `SMB`.
`listener`	no	`:445`	Bind address. Binding `:445` usually needs elevated privileges.
`target_name`	no	`XODBOX`	The NetBIOS/DNS name advertised in the NTLMSSP challenge (target name + AV pairs). Set a realistic value (e.g. `CORP-FS01`) to blend in and avoid fingerprinting the server as xodbox. Cosmetic — it only affects what the client believes it connected to.

The old persist knob has been removed. Every handler’s interactions — including SMB — are now persisted centrally by the application (see below), so captured hashes always land in the interactions table and the web view. Note that NetNTLMv2 hashes are crackable credential material sitting on disk; protect the SQLite database accordingly.

Events

Action	Trigger	Data payload
`Connect`	Accepted a new connection.	none
`Negotiate`	First SMB2 `NEGOTIATE` seen on the connection.	none
`Auth`	Client sent an NTLMSSP AUTHENTICATE.	NetNTLMv2 hash (hashcat mode 5600)
`Disconnect`	The exchange ended (EOF, error, or `Stop()`).	none

Feed a captured Auth payload straight to hashcat -m 5600 or john --format=netntlmv2.

Each event is persisted to the interactions table by the application’s central event loop (every handler’s events are stored, not just SMB’s). An Auth capture lands as handler=smb, request_type=Auth, with the DOMAIN\User in request_target and the hashcat line in data, so it survives restarts and appears in the web view.

Operational notes

Only NTLMv2 is captured. LM-only / NTLMv1 clients (rare, and usually disabled) are logged and skipped.
The advertised target name defaults to XODBOX and is configurable via target_name; it only affects what the client believes it connected to, so set a realistic value to avoid fingerprinting.
No SMB library is vendored — the minimal SMB2/NTLMSSP/SPNEGO wire format is implemented in-package, so the handler adds no dependencies.
The accept loop returns from Start() cleanly when Stop() closes the listener; in-flight connections are closed so their goroutines exit.
Only use this against systems you are authorized to test.