local datetime = require "datetime" local os = require "os" local bin = require "bin" local comm = require "comm" local shortport = require "shortport" local stdnse = require "stdnse" local smbauth = require "smbauth" local string = require "string" description = [[ This script enumerates information from remote Microsoft Telnet services with NTLM authentication enabled. Sending a MS-TNAP NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version. ]] --- -- @usage -- nmap -p 23 --script telnet-ntlm-info -- -- @output -- 23/tcp open telnet -- | telnet-ntlm-info: -- | Target_Name: ACTIVETELNET -- | NetBIOS_Domain_Name: ACTIVETELNET -- | NetBIOS_Computer_Name: HOST-TEST2 -- | DNS_Domain_Name: somedomain.com -- | DNS_Computer_Name: host-test2.somedomain.com -- | DNS_Tree_Name: somedomain.com -- |_ Product_Version: 5.1.2600 -- --@xmloutput -- ACTIVETELNET -- ACTIVETELNET -- HOST-TEST2 -- somedomain.com -- host-test2.somedomain.com -- somedomain.com -- 5.1.2600 author = "Justin Cacak" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"default", "discovery", "safe"} local _, ntlm_auth_blob = smbauth.get_security_blob( nil, nil, nil, nil, nil, nil, nil, 0x00000001 + -- Negotiate Unicode 0x00000002 + -- Negotiate OEM strings 0x00000004 + -- Request Target 0x00000200 + -- Negotiate NTLM 0x00008000 + -- Negotiate Always Sign 0x00080000 + -- Negotiate NTLM2 Key 0x20000000 + -- Negotiate 128 0x80000000 -- Negotiate 56 ) -- -- Create MS-TNAP Login Packet (Option Command IS) -- Ref: http://msdn.microsoft.com/en-us/library/cc247789.aspx local tnap_login_packet = bin.pack(" 0 then output.NetBIOS_Domain_Name = ntlm_decoded.netbios_domain_name end if ntlm_decoded.netbios_computer_name and #ntlm_decoded.netbios_computer_name > 0 then output.NetBIOS_Computer_Name = ntlm_decoded.netbios_computer_name end if ntlm_decoded.dns_domain_name and #ntlm_decoded.dns_domain_name > 0 then output.DNS_Domain_Name = ntlm_decoded.dns_domain_name end if ntlm_decoded.fqdn and #ntlm_decoded.fqdn > 0 then output.DNS_Computer_Name = ntlm_decoded.fqdn end if ntlm_decoded.dns_forest_name and #ntlm_decoded.dns_forest_name > 0 then output.DNS_Tree_Name = ntlm_decoded.dns_forest_name end if ntlm_decoded.os_major_version then output.Product_Version = string.format("%d.%d.%d", ntlm_decoded.os_major_version, ntlm_decoded.os_minor_version, ntlm_decoded.os_build) end return output end