v1.0.0.dev19: Spec-compliant NTLM hash extraction & documentation updates
·
111 commits
to master
since this release
This pull requests includes a complete revamp of the hash extraction from the NTLM authentication flow (huge shout-out to @StrongWind1 ) that also includes labeling the captured hashes correctly. A detailed overview of the changes introduced, refer to #22 (comment).
Added
- New configuration options for NTLM:
ntlm_disable_ess(replacesntlm_esswith inverted polarity)ntlm_disable_ntlmv2to force NTLMv1-only capturesntlm_challenge(fixed typo fromntlm_challange)
- Support for
hex:andascii:prefixes in NTLM challenge configuration - Enhanced hash extraction returning all crackable hash types (NetNTLMv2, NetLMv2, NetNTLMv1-ESS, NetNTLMv1)
- Dummy LM filtering to exclude null/empty-string LM hashes
- Detailed information of the client that tries to authenticate using the NTLM SSP (hostname, domain, version/OS)
- docstrings for all development-relevant modules
Changed
ntlm.pyfor spec-aligned hash extraction:- Improved version detection using payload length instead of ESS flag
- Proper flag echoing for SEAL, ALWAYS_SIGN, and KEY_EXCH
- Mutual exclusivity enforcement between ESS and LM_KEY
- Removed
NTLMSSP_AV_TIMEfrom AV_PAIRS to allow LMv2 capture
- Updated hash labels:
NTLMv1→NetNTLMv1,NTLMv1-ESS→NetNTLMv1-ESS,NTLMv2→NetNTLMv2,LMv2→NetLMv2 - Updated imports and configurations across all affected protocols (HTTP, IMAP, MSSQL, POP3, SMB, RPC, LDAP)
- Updated session config defaults and example
Dementor.toml - Updated FTP server implementation to be flexible for future additions
Fixed
- Spec-compliance gaps in NTLM hash capture quality
- Anonymous and null LMv2 filtering
- Invalid source code links in the documentation
Removed
- Single hash extraction limitation (now able to return multiple hashes per message)
- Removed
ProtocolLoggerMixinand merged functionality intoBaseRequestHandler
What's Changed
- Overhaul ntlm.py for Spec-Aligned Hash Extraction by @StrongWind1 in #23
- Docs: Add Python docstrings by @MatrixEditor in #26
New Contributors
- @StrongWind1 made their first contribution in #23
Full Changelog: v1.0.0.dev18...v1.0.0.dev19