Re: Samba Client using Password Hash

From: ``S@securityfocus.com, [h]@securityfocus.com iff`` (``S@securityfocus.com)
Date: 02/28/02


From: ``S@securityfocus.com, [h]@securityfocus.com iff`` <sh1ff@ciudad.com.ar>
To: pen-test@securityfocus.com
Date: Thu, 28 Feb 2002 03:49:54 -0300

SMBProxy is a "Passing The Hash" tool that works as a proxy.
It makes it possible to authenticate to a Windows NT4/2000
server by only knowing the md4 hash. It also makes it
possible to mount shares, access the registry and anything
else you could do with that particular users privileges.

[Download it http://mal0r.ciapsi.com.ar/smbproxy.tgz]

> Hi,
>
> I understand that there exists a modified version of the SAMBA smbclient
> that allows the ability to logon to NT from UNIX using only the password
> hash.
>
> I downloaded samba 2.2.3a this morning but I cant find any documentation
> regarding this feature.
>
> Can someone point me to the right smbclient version and some man pages
> explaining how to do it ?
>
> much appreciated. Helmut
>

Salutes ``S[h]iff``
Infobyte Securty Research
:)

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/



Relevant Pages

  • RE: NAI ePolicy Orchestrator
    ... Subject: NAI ePolicy Orchestrator ... using the sa account -- the password hash is even there. ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: NAI ePolicy Orchestrator
    ... Subject: NAI ePolicy Orchestrator ... "ePolicy Orchestrator Agent Log" on this port.. ... using the sa account -- the password hash is even there. ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • Re: Brute force .htpasswd
    ... DV> If you take a MD5 hash from a Unix/Linux box, ... DV> (or .htpasswd) file using by Apache, ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • Re: faster scans? (nmap)
    ... one host using nmap for syn scans in burst mode with the ... >>>This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: pen test help please asap
    ... > Machine A on client site makes a configurable encrypted OUTBOUND ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)