Skip to content

Commit 862c6a9

Browse files
committed
Log ntlm_session hashes too
Despite being called ntlm_session, these hashes are capable of being cracked as the John 'netntlm' format. Additionally the format is reported as NTLMv1-SSP in similar tools.
1 parent a1613d6 commit 862c6a9

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lib/msf/core/exploit/remote/smb/server/hash_capture.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ def report_ntlm_type3(address:, ntlm_type1:, ntlm_type2:, ntlm_type3:)
3838
combined_hash = "#{user}::#{domain}"
3939

4040
case ntlm_message.ntlm_version
41-
when :ntlmv1
41+
when :ntlmv1, :ntlm2_session
4242
hash_type = 'NTLMv1-SSP'
4343
client_hash = "#{bin_to_hex(ntlm_message.lm_response)}:#{bin_to_hex(ntlm_message.ntlm_response)}"
4444

0 commit comments

Comments
 (0)