Re: [NSE] SMB authentication patch

[David Fifield <david () bamsoftware com>]

On Fri, Oct 10, 2008 at 10:31:23AM -0500, Ron wrote:
> The parameter for the username is supposed to be 'smbusername', not  
> 'smbuser' (although 'smbuser' does sound better, I think I'll change the  
> script to accept them both). I definitely need to fix that error  
> handling, though.

With that little change it works great:

Host script results:
|  NBSTAT: NetBIOS name: MAC-MINI, NetBIOS user: <unknown>, NetBIOS MAC: 00:16:cb:ae:d4:ac
|  Name: MAC-MINI<00>         Flags: <unique><active>
|  Name: MSHOME<00>           Flags: <group><active>
|  Name: MAC-MINI<20>         Flags: <unique><active>
|  Name: MSHOME<1e>           Flags: <group><active>
|  Name: MSHOME<1d>           Flags: <unique><active>
|  Name: \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
|_ Statistics: 00 16 cb ae d4 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00
|  OS from SMB: Windows XP
|  LAN Manager: Windows 2000 LAN Manager
|  Name: MSHOME\MAC-MINI
|_ System time: 2008-10-10 14:28:20 UTC-6
|  SMB Security: User-level authentication
|  SMB Security: Challenge/response passwords supported
|_ SMB Security: Message signing not supported
|_ MSRPC: List of domains: ERROR: STATUS_ACCESS_DENIED (samr.opendomain)
|  MSRPC: List of user accounts:
|  Enum via SAMR error: STATUS_ACCESS_DENIED (samr.opendomain)
|  ,\xE0J\xC0V
|    |_ Domain: MAC-MINI
|    |_ RID: 1010
|  Administrator
|    |_ Domain: MAC-MINI
|    |_ RID: 500
|  Guest
|    |_ Domain: MAC-MINI
|    |_ RID: 501
|  HelpAssistant
|    |_ Domain: MAC-MINI
|    |_ RID: 1000
|  HelpServicesGroup
|    |_ Domain: MAC-MINI
|    |_ RID: 1002
|  jrandom
|    |_ Domain: MAC-MINI
|    |_ RID: 1019
|  Kurt G\xF6del
|    |_ Domain: MAC-MINI
|    |_ RID: 1018
|  SUPPORT_388945a0
|    |_ Domain: MAC-MINI
|_   |_ RID: 1003
|  MSRPC: NetShareEnumAll():
|  Anonymous shares: IPC$
|_ Restricted shares: print$, SharedDocs, My Pictures, ADMIN$, C$, Printer

How wonderful that Windows is willing to reveal all this information! I
should mention that the output is a lot shorter without -d3.

How come I don't see my main "david" account? Is it because it's the
same as the Administrator account? It was the account I set up the
computer with.

It's hard to give a blank password. Just using
        --script-args smbusername=user
doesn't work, using
        --script-args smbusername=user,smbpassword=
doesn't work ("Error parsing --script-args"). I had to use
        --script-args smbusername=user,smbpassword=\'\'

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org