NTLMRecon - A Tool To Enumerate Information From NTLM Authentication Enabled Web Endpoints
Note that the tool is still under development. Things may break anytime - hence, beta!A fast and flexible NTLM reconnaissance tool without external dependencies. Useful to find out information about NTLM endpoints when working with a large set of potential IP addresses and domains.
NTLMRecon is built with flexibilty in mind. Need to run recon on a single URL, an IP address, an entire CIDR range or combination of all of it all put in a single input file? No problem! NTLMRecon got you covered. Read on.
Internal wordlists are from the awesome nyxgeek/lyncsmash repo
Overview
NTLMRecon looks for NTLM enabled web endpoints, sends a fake authentication request and enumerates the following information from the NTLMSSP response:
- AD Domain Name
- Server name
- DNS Domain Name
- FQDN
- Parent DNS Domain
http-ntlm-info
for every successful discovery.Installation
Arch
If you're on Arch Linux or any Arch linux based distribution, you can grab the latest build from AUR
Generic Installation
- Clone the repository -
git clone https://github.com/sachinkamath/ntlmrecon/
- RECOMMENDED - Install virtualenv
pip install virtualenv
- Start a new virtual environment -
virtualenv venv
and activate it withsource venv/bin/activate
- Run the setup file -
python setup.py install
- Run ntlmrecon -
ntlmrecon --help
Usage
_ _ _____ _ ___ _________
| \ | |_ _| | | \/ || ___ \
| \| | | | | | | . . || |_/ /___ ___ ___ _ __
| . ` | | | | | | |\/| || // _ \/ __/ _ \| '_ \
| |\ | | | | |____| | | || |\ \ __/ (_| (_) | | | |
\_| \_/ \_/ \_____/\_| |_/\_| \_\___|\___\___/|_| |_|
v.0.1 beta - Y'all still exposing NTLM endpoints?
usage: ntlmrecon [-h] [--input INPUT | --infile INFILE] [--wordlist WORDLIST] [--threads THREADS] [--output-type] --outfile OUTFILE [--random-user-agent] [--force-all] [--shuffle]
optional arguments:
-h, --help show this help message and exit
--input INPUT Pass input as an IP address, URL or CIDR to enumerate NTLM endpoints
--infile INFILE Pass input from a local file
--wordlist WORDLIST O verride the internal wordlist with a custom wordlist
--threads THREADS Set number of threads (Default: 10)
--output-type, -o Set output type. JSON and CSV supported (Default: CSV) (TODO: JSON)
--outfile OUTFILE Set output file name (Default: ntlmrecon.csv)
--random-user-agent TODO: Randomize user agents when sending requests (Default: False) (TODO)
--force-all Force enumerate all endpoints even if a valid endpoint is found for a URL (Default : False)
--shuffle Break order of the input files (TODO: Improve logic)
Example Usage
Recon on a single URL
$ ntlmrecon --input https://mail.contoso.com --outfile ntlmrecon.csv
Recon on a CIDR range or IP address
$ ntlmrecon --input 192.168.1.1/24 --outfile ntlmrecon-ranges.csv
Recon on an input file
NTLM recon automatically detects the type of input per line and gives you results automatically. CIDR ranges are expanded automatically even when read from a text file.
Input file can be something as mixed up as :
mail.contoso.com
CONTOSOHOSTNAME
10.0.13.2/28
192.168.222.1/24
https://mail.contoso.com
To run recon with an input file, just run :$ ntlmrecon --infile /path/to/input/file --outfile ntlmrecon-fromfile.csv
Feedback
If you'd like to see a feature added into the tool or something doesn't work for you, please open a new issue
NTLMRecon - A Tool To Enumerate Information From NTLM Authentication Enabled Web Endpoints
Reviewed by Zion3R
on
6:00 PM
Rating: