Quindi, esegui alcuni test dopo aver visto un risponditore twittare dove SMBv2 è supportato ( link ) e testare uno scenario con Windows 7 Ricerca SMB per un host non valido.
Il rispondente sta restituendo il seguente:
[SMBv2] NTLMv2-SSP Client : 192.168.20.123
[SMBv2] NTLMv2-SSP Username : WIN7\User
[SMBv2] NTLMv2-SSP Hash : User::WIN7:1122334455667788:918C53A0FC0CC877D6B785C8133D9ACD:0101000000000000C0653150DE09D201A9D7C1900B59E56A000000000200080053004D004200330001001E00570049004E002D00500052004800340039003200520051004100460056000400140053004D00420033002E006C006F00630061006C0003003400570049004E002D00500052004800340039003200520051004100460056002E0053004D00420033002E006C006F00630061006C000500140053004D00420033002E006C006F00630061006C0007000800C0653150DE09D201060004000200000008003000300000000000000001000000002000001836D161A44DB8785583E68FEE498FAFC1327F4A1D47BE7F60A537083A1819A80A0010000000000000000000000000000000000009002C0063006900660073002F00730065007200760032002E006C006F00630061006C0064006F006D00610069006E00000000000000000000000000
Conosco la password dell'utente come 'test' e prendo l'hash con john con:
john hash.txt --wordlist=pass.txt
(che contiene un piccolo elenco di password, inclusa la mia vera password)
John non crolla con successo l'hash.
Se prendo la risposta di WebDav, posso rompere con successo l'hash:
[HTTP] Sending NTLM authentication request to 192.168.20.123
[HTTP] Host : serv2
[WebDAV] NTLMv2 Client : 192.168.20.123
[WebDAV] NTLMv2 Username : WIN7\User
[WebDAV] NTLMv2 Hash : User::WIN7:1122334455667788:51F5AFC2AA91C7B5898FBA412C3B6774:010100000000000087D5B0149127D20106530EB5ABDD4926000000000200060053004D0042000100160053004D0042002D0054004F004F004C004B00490054000400120073006D0062002E006C006F00630061006C000300280073006500720076006500720032003000300033002E0073006D0062002E006C006F00630061006C000500120073006D0062002E006C006F00630061006C0008003000300000000000000001000000002000001836D161A44DB8785583E68FEE498FAFC1327F4A1D47BE7F60A537083A1819A80A0010000000000000000000000000000000000009002C0048005400540050002F00730065007200760032002E006C006F00630061006C0064006F006D00610069006E000000000000000000
Qualche consiglio? Cosa mi manca qui?
Grazie