Merge pull request #1 from hmoore-r7/smtp_ntlm_domain

Module cleanup, error handling, and reporting

Author: medievia96

lib/msf/core/exploit/smtp.rb

@@ -24,8 +24,8 @@ def initialize(info = {})
       [
         Opt::RHOST,
         Opt::RPORT(25),
-        OptString.new('MAILFROM', [ true, 'FROM address of the e-mail', '[email protected]']),
-        OptString.new('MAILTO', [ true, 'TO address of the e-mail', '[email protected]']),
+        OptString.new('MAILFROM', [ true, 'FROM address of the e-mail', '[email protected]']),
+        OptString.new('MAILTO', [ true, 'TO address of the e-mail', '[email protected]']),
       ], Msf::Exploit::Remote::Smtp)
     register_autofilter_ports([ 25, 465, 587, 2525, 25025, 25000])
     register_autofilter_services(%W{ smtp smtps})

modules/auxiliary/scanner/smtp/smtp_ntlm_domain.rb

@@ -14,9 +14,9 @@ class Metasploit3 < Msf::Auxiliary
   def initialize
     super(
       'Name'        => 'SMTP NTLM Domain Extraction',
-      'Description' => 'Extract the Windows domain name given an NTLM challenge.',
+      'Description' => 'Extract the Windows domain name from a SMTP NTLM challenge.',
       'References'  => [ ['URL', 'http://msdn.microsoft.com/en-us/library/cc246870.aspx' ] ],
-      'Author'      => [ 'Rich Whitcroft <rwhitcroft@digitalboundary.net>' ],
+      'Author'      => [ 'Rich Whitcroft <rwhitcroft[at]digitalboundary.net>' ],
       'License'     => MSF_LICENSE
     )
 
@@ -33,48 +33,91 @@ def run_host(ip)
     begin
       domain = nil
       connect
-      print_status("Connected to #{ip}:#{datastore['RPORT']}")
 
-      # send a EHLO and parse the extensions returned
+      unless banner
+        vprint_error("#{rhost}:#{rport} No banner received, aborting...")
+        return
+      end
+
+      vprint_status("#{rhost}:#{rport} Connected: #{banner.strip.inspect}")
+
+      # Report the last line of the banner as services information (typically the interesting one)
+      report_service(host: rhost, port: rport, name: 'smtp', proto: 'tcp', info: banner.strip.split("\n").last)
+
+      # Send a EHLO and parse the extensions returned
       sock.puts("EHLO " + datastore['EHLO_DOMAIN'] + "\r\n")
-      exts = sock.get_once.split(/\n/)
 
-      # loop through all returned extensions related to NTLM
-      exts.grep(/NTLM/).each do |ext|
+      # Find all NTLM references in the EHLO response
+      exts = sock.get_once.to_s.split(/\n/).grep(/NTLM/)
+      if exts.length == 0
+        vprint_error("#{rhost}:#{rport} No NTLM extensions found")
+        return
+      end
+
+      exts.each do |ext|
 
-        # extract the reply minus the first 4 chars (response code + dash)
+        # Extract the reply minus the first 4 chars (response code + dash)
         e = ext[4..-1].chomp
 
-        # try the usual AUTH NTLM approach if possible, otherwise echo the extension back to server
+        # Try the usual AUTH NTLM approach if possible, otherwise echo the extension back to server
         if e =~ /AUTH.*NTLM/
           sock.puts("AUTH NTLM\r\n")
+          vprint_status("#{rhost}:#{rport} Sending AUTH NTLM")
         else
           sock.puts(e + "\r\n")
+          vprint_status("#{rhost}:#{rport} Sending #{e}")
         end
 
-        # we expect a "334" code to go ahead with NTLM auth
-        reply = sock.get_once
-        if reply.include?("334")
-          # send the NTLM AUTH blob to tell the server we're ready to auth
+        # We expect a "334" code to go ahead with NTLM auth
+        reply = sock.get_once.to_s
+        if reply !~ /^334\s+/m
+          vprint_status("#{rhost}:#{rport} Expected a 334 response, received #{reply.strip.inspect} aborting...")
+          break
+        else
+          # Send the NTLM AUTH blob to tell the server we're ready to auth
           blob = "TlRMTVNTUAABAAAAt4II4gAAAAAAAAAAAAAAAAAAAAAFAs4OAAAADw=="
           sock.puts(blob + "\r\n")
 
-          # capture the challenge sent by server
-          challenge = sock.get_once.split.last
-
-          # and extract the domain out of it
-          domain = Rex::Proto::NTLM::Message.parse(Rex::Text.decode_base64(challenge))[:target_name].value().gsub(/\0/, '')
-          print_good("Domain: #{domain}")
-        else
-          print_error("Error in response: expected '334', aborting")
+          # Capture the challenge sent by server
+          challenge = sock.get_once.to_s.split(/\s+/).last
+
+          if challenge.length == 0
+            vprint_status("#{rhost}:#{rport} Empty challenge response, aborting...")
+            break
+          end
+
+          begin
+            # Extract the domain out of the NTLM response
+            ntlm_reply = Rex::Proto::NTLM::Message.parse(Rex::Text.decode_base64(challenge))
+            if ! ntlm_reply && ntlm_reply.has_key?(:target_name)
+              vprint_status("#{rhost}:#{rport} Invalid challenge response, aborting...")
+              break
+            end
+
+            # TODO: Extract the server name from :target_info as well
+            domain = ntlm_reply[:target_name].value.to_s.gsub(/\x00/, '')
+            if domain.to_s.length == 0
+              vprint_status("#{rhost}:#{rport} Invalid target name in challenge response, aborting...")
+              break
+            end
+
+            print_good("#{rhost}:#{rport} Domain: #{domain}")
+            report_note(host: rhost, port: rport, proto: 'tcp', type: 'smtp.ntlm_auth_info', data: { domain: domain })
+            break
+
+          rescue ::Rex::ArgumentError
+            vprint_status("#{rhost}:#{rport} Invalid challenge response message, aborting...")
+            break
+          end
         end
       end
 
-      print_error("#{ip}: No NTLM extensions found") if domain.nil? or domain.empty?
+      if ! domain
+        vprint_error("#{rhost}:#{rport} No NTLM domain found")
+      end
 
-    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-    rescue Timeout::Error => err
-      print_error(err.message)
+    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error
+      # Ignore common networking and response timeout errors
     ensure
       disconnect
     end