Discovering directories w/ NTLM

ID: ntlm-directories

Severity: info

Author: puzzlepeaches,incogbyte,missing0x00,incogbyte

Tags: miscellaneous,misc,fuzz,windows

Description

YAML Source

id: ntlm-directories

info:
  name: Discovering directories w/ NTLM
  author: puzzlepeaches,incogbyte,missing0x00,incogbyte
  severity: info
  reference:
    - https://medium.com/swlh/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666
  metadata:
    max-request: 48
  tags: miscellaneous,misc,fuzz,windows

http:
  - raw:
      - |
        GET {{path}} HTTP/1.1
        Host: {{Hostname}}
        Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=

    threads: 10
    payloads:
      path:
        - /
        - /abs/
        - /ecp/
        - /etc/
        - /ews/
        - /mcx/
        - /oab/
        - /owa/
        - /rgs/
        - /rpc/
        - /conf/
        - /meet/
        - /ocsp/
        - /ucwa/
        - /adfs/
        - /dialin/
        - /public/
        - /certsrv/
        - /exchweb/
        - /meeting/
        - /certprov/
        - /exchange/
        - /scheduler/
        - /webticket/
        - /autoupdate/
        - /certenroll/
        - /powershell/
        - /rgsclients/
        - /rpcwithcert/
        - /autodiscover/
        - /hybridconfig/
        - /reach/sip.svc
        - /aspnet_client/
        - /groupexpansion/
        - /persistentchat/
        - /requesthandler/
        - /unifiedmessaging/
        - /mcx/mcxservice.svc
        - /phoneconferencing/
        - /requesthandlerext/
        - /deviceupdatefiles_ext/
        - /deviceupdatefiles_int/
        - /microsoft-server-activesync/
        - /webticket/webticketservice.svc
        - /webticket/webticketservice.svcabs/
        - /adfs/services/trust/2005/windowstransport
        - /internal_windows_authentication/
        - /RDWeb/FeedLogin/WebFeedLogin.aspx
        - /adfs/ls/wia

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(header), 'www-authenticate: ntlm')"

      - type: status
        status:
          - 401

    extractors:
      - type: kval
        kval:
          - 'www_authenticate'
# digest: 4b0a0048304602210081daba7fea69fbcdf16b0d8a9d129eba6969a4d80d352e361e39cd07d9cb35e70221009741def91daa47b39be4c7b8e8b87a6b0342b83c91f7de64559788166d010283:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/miscellaneous/ntlm-directories.yaml"

View on Github