SMB

Purpose

A fake SMB server for authorized engagements. It speaks just enough SMB2 to walk a client through NTLM authentication and capture the resulting NetNTLMv2 response as a hashcat-crackable hash. Point a target at \\your-host\share (via a coerced UNC path, img src=file://…, RESPONDER-style poisoning, an SSRF, etc.) and, if it authenticates, you get its hash.

It never grants a session — every authentication attempt is answered with a logon failure once the hash has been recorded. No credentials are verified and no shares are served.

Behaviour

• Listens on tcp4 at the configured listener address (SMB direct-host, default :445).

• Answers a legacy SMB1 multi-protocol negotiate with an SMB2 wildcard so the client re-negotiates over SMB2; answers SMB2 NEGOTIATE with dialect 2.1 and a SPNEGO token advertising NTLMSSP.

• On SESSION_SETUP, returns an NTLMSSP CHALLENGE with the fixed server challenge 0x1122334455667788 (the Responder/Impacket convention, so captured hashes work with existing tooling).

• Parses the client’s NTLMSSP AUTHENTICATE, extracts the domain, user and NT challenge response, and emits an Auth event whose Data() is the hashcat mode 5600 line:

  user::domain:1122334455667788:<NTProofStr>:<clientBlob>
  

• Answers the authenticate with STATUS_LOGON_FAILURE and closes.

Configuration

The old persist knob has been removed. Every handler’s interactions — including SMB — are now persisted centrally by the application (see below), so captured hashes always land in the interactions table and the web view. Note that NetNTLMv2 hashes are crackable credential material sitting on disk; protect the SQLite database accordingly.

Events

Feed a captured Auth payload straight to hashcat -m 5600 or john --format=netntlmv2.

Each event is persisted to the interactions table by the application’s central event loop (every handler’s events are stored, not just SMB’s). An Auth capture lands as handler=smb, request_type=Auth, with the DOMAIN\User in request_target and the hashcat line in data, so it survives restarts and appears in the web view.

Operational notes

• Only NTLMv2 is captured. LM-only / NTLMv1 clients (rare, and usually disabled) are logged and skipped.
• The advertised target name defaults to XODBOX and is configurable via target_name; it only affects what the client believes it connected to, so set a realistic value to avoid fingerprinting.
• No SMB library is vendored — the minimal SMB2/NTLMSSP/SPNEGO wire format is implemented in-package, so the handler adds no dependencies.
• The accept loop returns from Start() cleanly when Stop() closes the listener; in-flight connections are closed so their goroutines exit.
• Only use this against systems you are authorized to test.