Expand description
Minimal SMB2 server that captures NetNTLMv2 — the Responder/ntlmrelayx capture side. It speaks just enough SMB2 to make a client complete an NTLM auth: NEGOTIATE → SESSION_SETUP (challenge with the fixed server challenge) → SESSION_SETUP (grab the AUTHENTICATE). Pair it with coercion (PrinterBug/PetitPotam) or name poisoning; the captured hash is hashcat -m 5600. It never grants access — auth is rejected after capture.
Structs§
- Relay
Conn - One inbound SMB client being relayed: instead of answering the NTLM challenge with our own fixed value (capture), we hand the victim’s Type1 out to the caller, relay back the target’s Type2, and surrender the victim’s Type3 — so the caller can complete an authenticated session to a third-party target as the victim.
Functions§
- capture
- Listen on
addrand print each captured NetNTLMv2 (dedup by account). Runs until Ctrl-C.