NTLMRecon is a fast and flexible NTLM reconnaissance tool without external dependencies. Useful to find out information about NTLM endpoints when working with a large set of potential IP addresses and domains.
NTLMRecon is built with flexibilty in mind. Need to run recon on a single URL, an IP address, an entire CIDR range or combination of all of it all put in a single input file? No problem! NTLMRecon got you covered. Read on.
NTLMRecon looks for NTLM enabled web endpoints, sends a fake authentication request and enumerates the following information from the NTLMSSP response:
Since NTLMRecon leverages a python implementation of NTLMSSP, it eliminates the overhead of running Nmap NSE http-ntlm-info for every successful discovery.
On every successful discovery of a NTLM enabled web endpoint, the tool enumerates and saves information about the domain as follows to a CSV file :
| URL | Domain Name | Server Name | DNS Domain Name | FQDN | DNS Domain |
|---|---|---|---|---|---|
| https://contoso.com/EWS/ | XCORP | EXCHANGE01 | xcorp.contoso.net | EXCHANGE01.xcorp.contoso.net | contoso.net |
NTLMRecon is already packaged for BlackArch and can be installed by running pacman -S ntlmrecon
If you’re on Arch Linux or any Arch linux based distribution, you can grab the latest build from the Arch User Repository.
git clone https://github.com/pwnfoo/ntlmrecon/pip install virtualenvvirtualenv venv and activate it with source venv/bin/activatepython setup.py installntlmrecon --help$ ntlmrecon –help
_ _ _
| \ | | | | | \/ || \
| | | | | | | | . . || |/ / _
| . ` | | | | | | |\/| || // _ \/ / _ | ‘_ \ | |\ | | | | || | | || |\ \ / (| () | | | | _| _/ _/ _/_| |/_| ___|______/|| || – @pwnfoo
v.0.4 beta – Y’all still exposing NTLM endpoints?
Bug Reports, Feature Requests : https://git.io/JIR5z
usage: ntlmrecon [-h] [–input INPUT | –infile INFILE] [–wordlist WORDLIST]
[–threads THREADS] [–output-type] [–outfile OUTFILE]
[–random-user-agent] [–force-all] [–shuffle] [-f]
optional arguments:
-h, –help show this help message and exit
–input INPUT, -i INPUT
Pass input as an IP address, URL or CIDR to enumerate
NTLM endpoints
–infile INFILE, -I INFILE
Pass input from a local file
–wordlist WORDLIST Override the internal wordlist with a custom wordlist
–threads THREADS Set number of threads (Default: 10)
–output-type, -o Set output type. JSON (TODO) and CSV supported
(Default: CSV)
–outfile OUTFILE, -O OUTFILE
Set output file name (Default: ntlmrecon.csv)
–random-user-agent TODO: Randomize user agents when sending requests
(Default: False)
–force-all Force enumerate all endpoints even if a valid endpoint
is found for a URL (Default : False)
–shuffle Break order of the input files
-f, –force Force replace output file if it already exists
$ ntlmrecon --input https://mail.contoso.com --outfile ntlmrecon.csv
$ ntlmrecon --input 192.168.1.1/24 --outfile ntlmrecon-ranges.csv
The tool automatically detects the type of input per line and takes actions accordingly. CIDR ranges are expanded by default (please note that there is no de-duplication baked in just yet!)
Input file can be something as mixed up as :
mail.contoso.com
CONTOSOHOSTNAME
10.0.13.2/28
192.168.222.1/24
https://mail.contoso.com
To run recon with an input file, just run :
$ ntlmrecon –infile /path/to/input/file –outfile ntlmrecon-fromfile.csv
Both git fetch and git pull talk to a remote repository, but they do very different things to your…
Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…
Email is still one of the most important communication channels inside modern applications. Password resets,…
Nginx is a high-performance web server and reverse proxy trusted by some of the largest…
ufw (Uncomplicated Firewall) sits on top of iptables (or nftables on newer systems) and replaces…
When you share a server with a team or investigate unexpected activity, the first question…