Expand description
A minimal SMB2 client — the impacket smb3/smbconnection equivalent, scoped to what
named-pipe DCE/RPC needs: negotiate (dialect 2.1.0), NTLM session setup, tree-connect to
IPC$, create a pipe, and FSCTL_PIPE_TRANSCEIVE to carry RPC PDUs.
Raw NTLMSSP is placed directly in the session-setup security buffer (Windows accepts it without a SPNEGO wrapper). SMB 2.x message signing (HMAC-SHA256, truncated to 16 bytes) is applied once a session key is established, since DCs require signing on IPC$.
Re-exports§
Modules§
- client
- SmbClient — drives the SMB2 exchange up to a usable named-pipe transport for RPC. Flow: connect → negotiate → session-setup (NTLM, two round trips) → tree-connect IPC$ → create(pipe) → transact(). Post-authentication messages are signed.
- header
- SMB2 sync header (MS-SMB2 §2.2.1.2) — fixed 64 bytes, little-endian.
- msg
- SMB2 request bodies and response parsers (MS-SMB2 §2.2). Offsets in the on-wire
*Offsetfields are measured from the start of the SMB2 header (i.e.64 + body_off). - server
- Minimal SMB2 server that captures NetNTLMv2 — the Responder/ntlmrelayx capture side. It speaks just enough SMB2 to make a client complete an NTLM auth: NEGOTIATE → SESSION_SETUP (challenge with the fixed server challenge) → SESSION_SETUP (grab the AUTHENTICATE). Pair it with coercion (PrinterBug/PetitPotam) or name poisoning; the captured hash is hashcat -m 5600. It never grants access — auth is rejected after capture.
- socks
- Optional SOCKS5 egress. Every TCP dial in the stack (SMB here, plus RPC/LDAP/KDC/WinRM in the
crates that depend on this one) goes through
dial, which routes to a SOCKS5 proxy when one has been registered withset_proxy— the pivot support real engagements need. Hand-rolled (RFC 1928 CONNECT + RFC 1929 user/pass), consistent with the from-scratch stack. - spnego
- Minimal SPNEGO/GSS-API wrapping for SMB2 session setup. Windows expects the NTLM
token inside a SPNEGO
negTokenInit(first message) /negTokenResp(auth message), not raw NTLMSSP. We emit just enough hand-rolled DER for the NTLM-only mech list. - status
- SMB2 status codes we branch on.
- transport
- SMB over direct TCP/445: each message is prefixed with a 4-byte length (a zero byte then a 24-bit big-endian length), per the NetBIOS-less “direct TCP” framing.