Impacket DumpNTLMInfo.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Negotiates NTLM over SMB or RPC and displays challenge information, SMB settings, timestamps, and other details.
| Item | Details |
|---|---|
| Implementation | examples/DumpNTLMInfo.py |
| Category | SMB / MSRPC / NTLM |
| Size | 675 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/DumpNTLMInfo.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | |
-debug | Turn DEBUG output ON |
-ts | Adds timestamp to every logging output |
-target-ip | IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it |
-port | Destination SMB/RPC server port (default: 445) |
-protocol | Protocol to use (SMB or RPC); default: SMB, though port 135 normally uses RPC (choices: SMB, RPC) |
Detailed processing flow
Section titled “Detailed processing flow”The tool selects an SMB1, SMB2/3, or RPC implementation based on the protocol and port. It negotiates, obtains an NTLM challenge, and optionally attempts anonymous authentication. DumpNtlm converts the challenge and protocol-specific responses into a common display.
How it works
Section titled “How it works”The command observes negotiation data before establishing a fully authenticated session. Over SMB, it proceeds through dialect negotiation and part of Session Setup to obtain the server’s NTLM challenge. Over RPC, it sends a bind or request to an Endpoint Mapper or similar interface and likewise analyzes the challenge generated by the NTLM security provider.
The target information in an NTLM challenge is a set of AV pairs containing
NetBIOS and DNS computer names, domain names, timestamps, flags, and other values.
DumpNtlm extracts the challenge token from a protocol-specific packet, then
passes it to this common structure. For SMB, it also displays the dialect,
whether signing is required or enabled, server time, and maximum read and write sizes from the negotiate response.
SMB1 and SMB2/3 represent packet headers, commands, and capabilities differently,
so SMB1 and SMB3 implement their low-level requests separately. Correctly
identify the dialect after wildcard negotiation and decode subsequent packets
on the same socket. A successful or failed null session says something about
policy, but does not show whether ordinary users can authenticate.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
RPC | 65 | __init__(), GetChallange() |
SMB1 | 119 | __init__(), GetNegotiateResponse(), GetChallange(), Authenticate(), send(), receive() |
SMB3 | 277 | __init__(), GetNegotiateResponse(), GetChallange(), Authenticate(), send(), receive() |
SmbConnection | 398 | __init__(), IsSmb1Enabled(), NegotiateSession(), GetChallange(), Authenticate() |
DumpNtlm | 483 | __init__(), DisplayInfo(), DisplayRpcInfo(), DisplaySmbInfo(), DisplaySigning(), DisplayDialect(), DisplayIo(), DisplayTime(), DisplayChallangeInfo(), DisplayNullSession() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | nmb, ntlm, version |
impacket.examples | logger |
impacket.smb | NewSMBPacket, SMB, SMBCommand, SMBExtended_Security_Data, SMBExtended_Security_Parameters, SMBNTLMDialect_Data, SMBNTLMDialect_Parameters, SMBSessionSetupAndXResponse_Parameters, SMBSessionSetupAndX_Extended_Data, SMBSessionSetupAndX_Extended_Parameters, SMBSessionSetupAndX_Extended_Response_Data, SMBSessionSetupAndX_Extended_Response_Parameters, SMB_DIALECT, UnsupportedFeature |
impacket.smb3structs | * |
impacket.spnego | SPNEGO_NegTokenInit, SPNEGO_NegTokenResp, TypesMech |
impacket.nt_errors | STATUS_MORE_PROCESSING_REQUIRED, STATUS_SUCCESS |
impacket.uuid | uuidtup_to_bin |
impacket.dcerpc.v5 | epm, transport |
impacket.dcerpc.v5.rpcrt | * |
External packages (used directly)
Section titled “External packages (used directly)”| Import name | Distribution package | Import path and declaration status |
|---|---|---|
six | six | Imported directly; declared |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
When changing the implementation
Section titled “When changing the implementation”The code depends on low-level smb, smb3structs, ntlm, spnego, and dcerpc.v5.rpcrt, transport, and epm. It intentionally works below standard SMBConnection, so preserve packet fields and dialect-specific branches.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/DumpNTLMInfo.py - CLI:
python examples/DumpNTLMInfo.py -h - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/SMB_RPC/test_smb.py - Related test:
tests/SMB_RPC/test_smbserver.py - Related test:
tests/SMB_RPC/test_spnego.py - Related test:
tests/misc/test_dcerpc_v5_ndr.py