lgandx/Responder

Display hostname of DuT

archi opened this issue · 0 comments

I was looking at the SMB traffic in wireshark and noticed that it also contained the hostname of the DuT. This information isn't displayed, yet, and I was wondering if it was possible to add it?
Often it's no new/relevant information, but maybe it might be useful in some scenarios.

Both variants of saveToDb (from utils.py and Report.py) seem to already accept a hostname field. So it's likely just a matter of parsing this at

Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')

I'll played around with this, and this trivial diff works for me:

diff --git a/servers/SMB.py b/servers/SMB.py
index b93ebb7..3ba37c8 100644
--- a/servers/SMB.py
+++ b/servers/SMB.py
@@ -125,6 +125,9 @@ def ParseSMBHash(data,client, Challenge):  #Parse SMB NTLMSSP v1/v2
                UserLen      = struct.unpack('<H',SSPIString[38:40])[0]
                UserOffset   = struct.unpack('<H',SSPIString[40:42])[0]
                Username     = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
+               HostLen      = struct.unpack('<H',SSPIString[46:48])[0]
+               HostOffset   = struct.unpack('<H',SSPIString[48:50])[0]
+               Hostname     = SSPIString[HostOffset:HostOffset+HostLen].decode('UTF-16LE')
                WriteHash    = '%s::%s:%s:%s:%s' % (Username, Domain, codecs.encode(Challenge,'hex').decode('latin-1'), SMBHash[:32], SMBHash[32:])

                SaveToDb({
@@ -132,6 +135,7 @@ def ParseSMBHash(data,client, Challenge):  #Parse SMB NTLMSSP v1/v2
                        'type': 'NTLMv2-SSP',
                        'client': client,
                        'user': Domain+'\\'+Username,
+                       'hostname': Hostname,
                        'hash': SMBHash,
                        'fullhash': WriteHash,
                })

What surprises me is how there is a provision for this, but it's unused. Any reason that's not wanted, or is it just that no one got around to add this?

btw: Thanks for sharing the awesome work with the world! :)