ZackAttack! - Realying NTLM Like Nobody's Business
WTF Is This?
tl;dr version - ZackAttack! is a new Tool Set to do NTLM Authentication relaying unlike any other tool currently out there.
So how is ZackAttack! different / better? Compared to other tools...
- Supports NTLMv2 :)
- Brings up external impact for NTLM by relaying to external Exchange Web Services servers ( think mobile phone users :) )
- Custom Rogue HTTP and SMB Server funneling into a single pooled source and knows who the user is and keeps them authenticating without closing the socket
- Rule based logic to auto-perform actions upon seing a user belonging to a group. When no rule exists, the rogue server holds on to the auth session as long as possible until a rule or api request comes in.
- Auto / Guided generation to creating methods to get users to auto-authenticate without interaction
- New methods for client auto authentication including geting FF/Chrome to auto-auth via UNC SMB shares (similar to IE)
- Relaying to LDAP (critical for relaying to Domain Controllers), Exchange Web Services, and soon mssql.
- SOCKS proxy to allow NTLM relay attacks with your favorite tools (proxychains smbclient....etc)
- Focuses on not just poping the shells that traditional relays do, but leveraging dumb users as well and getting data through them.
So much for tl;dr ;) The goal? A Firesheep esque tool for relaying NTLM auths
How do I Get Started
1) ruby zackattack.rb
2) open your favorite browser to http://zf:zf@localhost:4531/
4) PROFIT! Or not. It's alpha still.
Code is written for ruby1.9 but should work with 1.8. Requires net/http(s) and webrick rubygems
So What Are the Components
The Rogue Servers - HTTP and SMB. These get the auth requests and keep recycling them
The Clients - These connect to target servers and request NTLM creds from the Rogue Servers
The Rules - Define auto actions to perform upon seeing a user.
The Payloads - Methods to get users to autoauth with Integrated Windows Auth ergo not prompting the user for auth.
XYZ Doesn't work
I'm sure it doesn't ;) I don't always code in ruby, but when i do, i make sure to introduce as many bugs as possible :)
Submit as much info as you can (comfortably) to the issues page. Please try to get a wireshark / pcap capture if it's a client issue. If it contains sensitive data (i.e. ntlm creds of a client) let me know and we can work around that if possible.
Feature request? I want to hear it! Check the todo file and see if i already mentioned it in there, otherwise submit!
I'll fill in more details later....