v1.2.6

What's Changed

Bug Fixes - SPNEGO / Authentication Layer spnego.py, mock_server.py

• !spnego - None ResponseToken in Type 2 challenge causes auth failure (impacket compatibility break): When PwnRM negotiated NTLM through SPNEGO against a server whose SPNEGO stack was assembled via impacket's pyasn1 binding, NegTokenResp["ResponseToken"] returned None rather than the raw NTLM Type 2 bytes. This occurred because impacket's SPNEGO_NegTokenResp only populates the field when the internal pyasn1 component path is written through the correct accessor — which differs between impacket versions — leaving the field unset despite the bytes being present in the DER envelope. Downstream, NTLMAuthChallenge(type2) received None, producing an immediate TypeError and aborting the handshake. Fixed in spnego.py:64-71 by scanning the raw data_in buffer for the NTLMSSP\x00 signature when ResponseToken is None, extracting the challenge directly from the blob, and raising SPNEGOError("SPNEGO: missing ResponseToken in Type 2 challenge") only if the signature is absent entirely.

• !mock_server - Fixed offset NTLM token detection breaks SPNEGO-wrapped NegTokenInit from impacket: The mock server's auth dispatch used a hardcoded token[8:12] byte slice to identify NTLM message type, assuming tokens always arrive as raw NTLMSSP. When Linux impacket sends a SPNEGO-wrapped NegTokenInit, the NTLMSSP signature appears at a variable offset inside the ASN.1 envelope — token[8:12] reads the wrong bytes, the type check falls through, and the server rejects valid negotiation tokens. Simultaneously, the original NTLM_CHALLENGE was a hand-rolled byte stub that did not conform to MS-NLMP §2.2.1.2 — missing proper TargetInfo AV_PAIRS, a valid server challenge value, and a well-formed Version field — causing impacket's strict ASN.1 parser to reject the challenge during the mock test cycle. Fixed in mock_server.py:218-232 by replacing the fixed-offset slice with token.find(b"NTLMSSP\x00") for signature detection, computing msg_type relative to sig_pos, and inserting a bare-SPNEGO fast path that issues a challenge and returns immediately when no NTLMSSP signature is found. NTLM_CHALLENGE was rebuilt via _build_ntlm_type2() (conforming to MS-NLMP §2.2.1.2 with MsvAvNbDomainName + MsvAvEOL AV_PAIRS and a non-zero ServerChallenge) and wrapped in a fully hand-rolled DER SPNEGO NegTokenResp via _build_spnego_challenge() (RFC 4178 §4.2.2) to avoid impacket version-dependent field-assignment behavior. Affected mock_server.py:49-110, 218-248.

Housekeeping

• Security advisory added to HALL_OF_FAME.md, crediting @fuzt3r for new bug advisory - GHSA-xhjp-r3m9-54vj!

Full Changelog: v1.2.5...v1.2.6