Retrieve the host information that is specified in the NTLM challenge.
This can be useful as a way to discover the names of the computers in an internal network, as an alternative to a reverse DNS query, but also to discover the name from the internal domain from hosts exposed to internet.
Currently it is possible to use the following application protocols to get an NTLM challenge:
- HTTP
- SMB
Quick example, to retrieve the names for the hosts in a local network you can do:
$ ntlm-info smb 192.168.100.0/24 -w 20
Target: 192.168.100.7
NbComputer: WS02-7
NbDomain: CONTOSO
DnsComputer: ws02-7.contoso.local
DnsDomain: contoso.local
Version: 6.1.7601
OS: Windows 7 | Windows Server 2008 R2
Target: 192.168.100.10
NbComputer: WS01-10
NbDomain: CONTOSO
DnsComputer: ws01-10.contoso.local
DnsDomain: contoso.local
Version: 10.0.19041
OS: Windows 10 | Windows Server 2019 | Windows Server 2016
As input for smb command, you can specify a...
- Hostname
- IP
- network CIDR
Moreover you can specify those in a file, in the parameters or stdin.
cat hosts.txt | ntlm-info smb
ntlm-info smb 192.168.100.10 192.168.100.7
ntlm-info smb 192.168.100.0/24
Quick example, to retrieve info of an http endpoint:
$ ntlm-info http https://contoso.com/
Target: 192.168.100.10
NbComputer: WS01-10
NbDomain: CONTOSO
DnsComputer: ws01-10.contoso.local
DnsDomain: contoso.local
Version: 10.0.19041
OS: Windows 10 | Windows Server 2019 | Windows Server 2016
As input for http command, you can specify one or several URLs.
Moreover you can specify those in a file, in the parameters or stdin.
cat urls.txt | ntlm-info http
ntlm-info http https://contoso.com/ https://company.com/owa
From crates:
cargo install ntlm-info
From repo:
cargo install --git https://github.com/Zer1t0/ntlm-info.git
To build it statically in Windows (Powershell):
git clone https://github.com/Zer1t0/ntlm-info.git
cd ntlm-info/
$env:RUSTFLAGS='-C target-feature=+crt-static'
cargo build --release
This tool was inspired by ntlm_challenger