HackTool.Python.Impacket.P

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Hacking Tool drops the following files:

• {malware path}/smb.log → created to record local SMB server connection events and transaction logs

Propagation

This Hacking Tool does not have any propagation routine.

Backdoor Routine

This Hacking Tool does not have any backdoor routine.

Rootkit Capabilities

This Hacking Tool does not have rootkit capabilities.

Information Theft

This Hacking Tool gathers the following data:

• When relaying authentication sessions against remote target systems, it gathers and steals the following information:
  • Command output (if the `-c` parameter is used)
  • Intercepted NTLM and NTLMv2 challenge-response hashes (NetNTLMv1 and NetNTLMv2), which can be saved to `{malware path}/{outputfile}.ntlm` and `{malware path}/{outputfile}.ntlmv2`
  • Local SAM database password hashes

Other Details

This Hacking Tool does the following:

• Operates in one of two execution modes:
  • Relay Mode: Enabled when the `-h {Host}` parameter is specified; displays the notification message `[*] Running in relay mode` and relays all intercepted authentication credentials to the designated target server.
  • Reflection Mode: Default mode when `-h` is omitted; displays the notification message `[*] Running in reflection mode` and reflects the intercepted authentication credentials directly back to the connecting client machine.
• Acts as a Man-in-the-Middle (MitM) credential relay server by launching an HTTP server on port 80 and an SMB server on port 445 to intercept incoming authentication attempts.
• Intercepts NTLM Negotiate, Challenge, and Authenticate tokens from connecting victim clients and forwards them in real time to designated target Windows servers or reflects them back to the client.
• When an authentication attempt succeeds against the target host, it performs one of the following attack routines depending on supplied parameters:
  • If `-e {File Path}` is specified: Uploads the executable to `ADMIN$\` and executes it with `NT AUTHORITY\SYSTEM` privileges by creating, starting, and subsequently deleting a temporary Windows service via the Service Control Manager (`\PIPE\svcctl`)
  • If `-c {Command}` is specified: Executes the command remotely via remote registry and service creation (`RemoteOperations`), writes output to `%SystemRoot%\Temp\__output`, retrieves the output, and deletes the temporary output file
  • If neither `-e` nor `-c` is specified (default): Dumps local Security Account Manager (SAM) password hashes by extracting the Boot Key / Syskey from the `SYSTEM` registry hive, saving the `SAM` hive, and parsing all local user account LM/NTLM hashes via `secretsdump.py`
• Launches a background SOCKS5 proxy server to maintain and tunnel authenticated SMB sessions when the `-socks` flag is enabled.
• Intercepts and logs NTLM and NTLMv2 challenge-response hashes to a specified output file in John the Ripper / Hashcat compatible format for offline password cracking.
• Opens a read-only `IPC$` share on its local SMB server and configures its transaction log file as `{malware path}/smb.log`.
• Rejects anonymous authentication attempts to compel victim clients into submitting credentials (except for local loopback connections from `127.0.0.1`).
• Masquerades as a UNIX Samba server by transmitting `UNIX` operating system strings and `Samba` NativeLanMan identifiers to targets during SMB negotiations.
• It takes advantage of the following exploit(s):
  • CVE-2015-0005: Microsoft Windows Netlogon Security Feature Bypass Vulnerability → used to calculate, log in hexadecimal format, and apply SMB signing session keys via RPC over `\PIPE\netlogon` when SMB packet signing is enforced on target systems
• Operates as an SMB adversary-in-the-middle exploitation engine within the open-source Impacket framework, leveraging Impacket SMB server and client libraries to perform NTLM reflection and relay attacks.

It accepts the following parameters:

• --help → used to show help message and exit
• -c {Command} → used to specify a command to execute on the target system If not specified, SAM password hashes are dumped
• -codec {Codec} → used to set the character encoding used for decoding command output from the target system (default: "ascii")
• -debug → used to enable diagnostic debug logging output
• -domain {Domain/IP} → used to specify the Domain FQDN or IP address to connect to using NETLOGON
• -e {File Path} → used to specify an executable file to upload and execute on the target system via a temporary Windows service
• -h {Host} → used to specify the target host to relay intercepted credentials to (runs in relay mode) If not specified, credentials are relayed back to the connecting client (runs in reflection mode)
• -machine-account {Account} → used to specify a domain machine account (domain/machine_name) to grab an SMB signing session key from NETLOGON
• -machine-hashes {LMHASH:NTHASH} → used to specify the domain machine account password hashes in LMHASH:NTHASH format
• -one-shot → used to execute the attack only once per target host following successful authentication
• -outputfile {Filename} → used to specify the base output filename to save intercepted NTLM and NTLMv2 challenge-response hashes in John the Ripper format
• -s {Status} → used to specify the status code to return to the connecting client after authentication (choices: 'success', 'denied', 'logon_failure'; default: "success")
• -socks → used to launch a background SOCKS proxy for the relayed connection
• -ts → used to prepend timestamps to console logging output