hunt-ntlm-info

Name: hunt-ntlm-info
Author: elementalsouls

3.0kstars461forks

How to install hunt-ntlm-info?

elementalsouls/claude-bughunter/hunt-ntlm-info

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-ntlm-info

Installs into the current project.

Summary

Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pa

Files · 1

View on GitHub

SKILL.md

1	## Crown Jewel Targets
2
3	NTLM info disclosure is a Medium-severity finding when chained to context — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:
4
5	- Internet-reachable IIS / SharePoint / Exchange / OWA with dual-auth (Forms + NTLM, or NTLM + Kerberos)
6	- Citrix NetScaler / VMware Horizon View internet-facing gateways with NTLM-backed AD auth
7	- Lync / Skype for Business / Teams On-Prem edge servers
8	- WSUS / Windows Update Services with NTLM-protected admin paths
9	- CIFS-style fileshare proxies (HCL Sametime, IBM Notes Domino) that proxy NTLM
10	- Legacy SharePoint farms that left NTLM enabled on the public-zone IIS binding
11
12	What makes this pay:
13	- Internal AD domain disclosure (parent-forest mapping, e.g. `customer.parent-corp.example` → tenant inside corporate-AD tree)
14	- Default-Windows-hostname disclosure (`WIN-XXXXXXXXXXX` pattern signals rushed provisioning → likely default service-account passwords)
15	- Timestamp leak (used in NTLMv2 hash cracking acceleration)
16	- Direct attack-map enrichment for credential spraying combined with `hunt-auth-bypass` Legacy-Protocol Matrix
17
18	---
19
20	## Attack Surface Signals
21
22	Response headers signaling NTLM availability:
23	```
24	WWW-Authenticate: NTLM
25	WWW-Authenticate: Negotiate
26	WWW-Authenticate: NTLM, Negotiate
27	WWW-Authenticate: Negotiate, NTLM
28	```
29
30	URL patterns where NTLM is commonly exposed:
31	```
32	/_api/web/CurrentUser (SharePoint REST)
33	/_vti_bin/*.asmx (SharePoint legacy SOAP)
34	/EWS/Exchange.asmx (Exchange Web Services)
35	/Autodiscover/Autodiscover.xml (Exchange autodiscover)
36	/owa/ (Outlook Web App)
37	/Microsoft-Server-ActiveSync (ActiveSync)
38	/PowerShell (Exchange Mgmt Shell over HTTPS)
39	/api/v3/ (TeamCity, Atlassian)
40	/wsus/ (Windows Server Update Services)
41	/manager/html (some Tomcat behind IIS)
42	/iisstart.htm (default IIS, sometimes reveals NTLM upstream)
43	```
44
45	Tech-stack signals:
46	- IIS on the public internet (almost always NTLM-capable, even if Forms is the front)
47	- SharePoint Web Front End (almost always dual-auth Forms + NTLM)
48	- Exchange edge transport
49	- Server header `Microsoft-HTTPAPI/2.0`, `Microsoft-IIS/`, `IIS/`
50
51	---
52
53	## Step-by-Step Hunting Methodology
54
55	1. Probe every anonymous endpoint for `WWW-Authenticate: NTLM`. Send a vanilla GET and inspect response headers. If NTLM is offered, proceed.
56
57	2. Send a valid NTLMSSP Type-1 message anonymously. The Type-1 base64 below requests NetBIOS-domain and Workstation info from the server:
58	```
59	Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==
60	```
61	This is the standard test Type-1 with negotiate flags `NTLMSSP_NEGOTIATE_UNICODE \| NTLMSSP_NEGOTIATE_OEM \| NTLMSSP_NEGOTIATE_NTLM \| NTLMSSP_NEGOTIATE_ALWAYS_SIGN \| NTLMSSP_NEGOTIATE_KEY_EXCH \| NTLMSSP_NEGOTIATE_56 \| NTLMSSP_NEGOTIATE_128 \| NTLMSSP_NEGOTIATE_TARGET_INFO`. The `OS Version` field (`06 01 B1 1D 00 00 00 0F`) is Windows 7 build 7601 — accepted by virtually every NTLM responder.
62
63	3. Use a keep-alive raw socket, not Python requests / curl one-shot. Most HTTP libraries close the connection between the Type-1 send and Type-2 reception. Use one of:
64	- Burp Repeater with `Connection: keep-alive` set explicitly
65	- Burp `mcp__burp__send_http1_request` (handles keep-alive natively)
66	- Python raw `socket` + `ssl.wrap_socket` (see Payload section)
67
68	4. Parse the Type-2 challenge from the `WWW-Authenticate: NTLM <base64>` response header. Base64-decode the value. The structure is NTLMSSP per MS-NLMP:
69	- Bytes 0-7: literal `NTLMSSP\0`
70	- Bytes 8-11: MessageType = `\x02\x00\x00\x00`
71	- Bytes 12-19: TargetName SecurityBuffer (len, alloc, offset)
72	- Bytes 20-23: NegotiateFlags
73	- Bytes 24-31: Server Challenge (8 bytes — useful for offline cracking)
74	- Bytes 40-47: TargetInfo SecurityBuffer (len, alloc, offset)
75	- TargetInfo body: `AV_PAIRS` array of (AvId u16, AvLen u16, Value)
76
77	5. Decode the AV_PAIRS. The AvIds you care about:
78	- `1` = NetBIOS Computer Name
79	- `2` = NetBIOS Domain Name
80	- `3` = DNS Computer Name (FQDN of the responding server)
81	- `4` = DNS Domain Name

People who liked this also viewed

6 picks

Type

hunt-ntlm-info

3.0kstars461forks

View on GitHub

How to install hunt-ntlm-info?

elementalsouls/claude-bughunter/hunt-ntlm-info

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-ntlm-info

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Crown Jewel Targets
2
3	NTLM info disclosure is a Medium-severity finding when chained to context — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:
4
5	- Internet-reachable IIS / SharePoint / Exchange / OWA with dual-auth (Forms + NTLM, or NTLM + Kerberos)
6	- Citrix NetScaler / VMware Horizon View internet-facing gateways with NTLM-backed AD auth
7	- Lync / Skype for Business / Teams On-Prem edge servers
8	- WSUS / Windows Update Services with NTLM-protected admin paths
9	- CIFS-style fileshare proxies (HCL Sametime, IBM Notes Domino) that proxy NTLM
10	- Legacy SharePoint farms that left NTLM enabled on the public-zone IIS binding
11
12	What makes this pay:
13	- Internal AD domain disclosure (parent-forest mapping, e.g. `customer.parent-corp.example` → tenant inside corporate-AD tree)
14	- Default-Windows-hostname disclosure (`WIN-XXXXXXXXXXX` pattern signals rushed provisioning → likely default service-account passwords)
15	- Timestamp leak (used in NTLMv2 hash cracking acceleration)
16	- Direct attack-map enrichment for credential spraying combined with `hunt-auth-bypass` Legacy-Protocol Matrix
17
18	---
19
20	## Attack Surface Signals
21
22	Response headers signaling NTLM availability:
23	```
24	WWW-Authenticate: NTLM
25	WWW-Authenticate: Negotiate
26	WWW-Authenticate: NTLM, Negotiate
27	WWW-Authenticate: Negotiate, NTLM
28	```
29
30	URL patterns where NTLM is commonly exposed:
31	```
32	/_api/web/CurrentUser (SharePoint REST)
33	/_vti_bin/*.asmx (SharePoint legacy SOAP)
34	/EWS/Exchange.asmx (Exchange Web Services)
35	/Autodiscover/Autodiscover.xml (Exchange autodiscover)
36	/owa/ (Outlook Web App)
37	/Microsoft-Server-ActiveSync (ActiveSync)
38	/PowerShell (Exchange Mgmt Shell over HTTPS)
39	/api/v3/ (TeamCity, Atlassian)
40	/wsus/ (Windows Server Update Services)
41	/manager/html (some Tomcat behind IIS)
42	/iisstart.htm (default IIS, sometimes reveals NTLM upstream)
43	```
44
45	Tech-stack signals:
46	- IIS on the public internet (almost always NTLM-capable, even if Forms is the front)
47	- SharePoint Web Front End (almost always dual-auth Forms + NTLM)
48	- Exchange edge transport
49	- Server header `Microsoft-HTTPAPI/2.0`, `Microsoft-IIS/`, `IIS/`
50
51	---
52
53	## Step-by-Step Hunting Methodology
54
55	1. Probe every anonymous endpoint for `WWW-Authenticate: NTLM`. Send a vanilla GET and inspect response headers. If NTLM is offered, proceed.
56
57	2. Send a valid NTLMSSP Type-1 message anonymously. The Type-1 base64 below requests NetBIOS-domain and Workstation info from the server:
58	```
59	Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==
60	```
61	This is the standard test Type-1 with negotiate flags `NTLMSSP_NEGOTIATE_UNICODE \| NTLMSSP_NEGOTIATE_OEM \| NTLMSSP_NEGOTIATE_NTLM \| NTLMSSP_NEGOTIATE_ALWAYS_SIGN \| NTLMSSP_NEGOTIATE_KEY_EXCH \| NTLMSSP_NEGOTIATE_56 \| NTLMSSP_NEGOTIATE_128 \| NTLMSSP_NEGOTIATE_TARGET_INFO`. The `OS Version` field (`06 01 B1 1D 00 00 00 0F`) is Windows 7 build 7601 — accepted by virtually every NTLM responder.
62
63	3. Use a keep-alive raw socket, not Python requests / curl one-shot. Most HTTP libraries close the connection between the Type-1 send and Type-2 reception. Use one of:
64	- Burp Repeater with `Connection: keep-alive` set explicitly
65	- Burp `mcp__burp__send_http1_request` (handles keep-alive natively)
66	- Python raw `socket` + `ssl.wrap_socket` (see Payload section)
67
68	4. Parse the Type-2 challenge from the `WWW-Authenticate: NTLM <base64>` response header. Base64-decode the value. The structure is NTLMSSP per MS-NLMP:
69	- Bytes 0-7: literal `NTLMSSP\0`
70	- Bytes 8-11: MessageType = `\x02\x00\x00\x00`
71	- Bytes 12-19: TargetName SecurityBuffer (len, alloc, offset)
72	- Bytes 20-23: NegotiateFlags
73	- Bytes 24-31: Server Challenge (8 bytes — useful for offline cracking)
74	- Bytes 40-47: TargetInfo SecurityBuffer (len, alloc, offset)
75	- TargetInfo body: `AV_PAIRS` array of (AvId u16, AvLen u16, Value)
76
77	5. Decode the AV_PAIRS. The AvIds you care about:
78	- `1` = NetBIOS Computer Name
79	- `2` = NetBIOS Domain Name
80	- `3` = DNS Computer Name (FQDN of the responding server)
81	- `4` = DNS Domain Name

People who liked this also viewed

6 picks

Type