Medusa Parallel Network Login Auditor :: SMBNT

JoMo-Kun / jmk "AT" foofus "DOT" net

The SMBNT module tests accounts against the Microsoft netbios-ssn (TCP/139) and microsoft-ds (TCP/445) services. Besides testing normal passwords, this module allows Medusa to directly test NTLM hashes against a Windows host. This may be useful for an auditor who has aquired a sam._ or pwdump file and would like to quickly determine which are valid entries.

Several "-m 'METHOD:VALUE'" options can be used with this module. The following are valid methods: GROUP, GROUP_OTHER, PASS and NETBIOS. The following values are useful for these methods:

Method Value Description
GROUP LOCAL* Check local account.
DOMAIN Check credentials against this hosts primary domain controller via this host.
BOTH Check both. This leaves the workgroup field set blank and then attempts to check the credentials against the host. If the account does not exist locally on the host being tested, that host then queries its domain controller.
GROUP_OTHER [user specified] Configure arbitrary domain for host to authenticate against.
PASS PASSWORD* Use a normal password.
HASH Use a NTLM hash rather than a password.
MACHINE Use the Machine's NetBIOS name as the password.
NETBIOS Force NetBIOS Mode (Disable Native Win2000 Mode)
  (*) Default value

The following examples demonstrate several uses of the SMBNT module:

Be careful of mass domain account lockout with this module. For example, assume you are checking several accounts against many domain workstations. If you are using either the "GROUP:DOMAIN" or the "GROUP:BOTH" option and these accounts do not exist locally on the workstations, each workstation will in turn check their respective domain controller. This could cause a bunch of lockouts. Of course, it'd look like the workstations, not you, were doing it. ;)

FYI, this code is unable to test accounts on default XP hosts which are not part of a domain and do not have normal file sharing enabled. Default XP does not allow shares and returns STATUS_LOGON_FAILED for both valid and invalid credentials. XP with simple sharing enabled returns SUCCESS for both valid and invalid credentials. If anyone knows a way to test in these configurations...

Medusa Documentation