hunt-ntlm-info

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Crown Jewel Targets

核心高价值目标

NTLM info disclosure is a Medium-severity finding when chained to context — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:

Internet-reachable IIS / SharePoint / Exchange / OWA with dual-auth (Forms + NTLM, or NTLM + Kerberos)
Citrix NetScaler / VMware Horizon View internet-facing gateways with NTLM-backed AD auth
Lync / Skype for Business / Teams On-Prem edge servers
WSUS / Windows Update Services with NTLM-protected admin paths
CIFS-style fileshare proxies (HCL Sametime, IBM Notes Domino) that proxy NTLM
Legacy SharePoint farms that left NTLM enabled on the public-zone IIS binding

What makes this pay:

Internal AD domain disclosure (parent-forest mapping, e.g.
```
customer.parent-corp.example
```
→ tenant inside corporate-AD tree)
Default-Windows-hostname disclosure (
```
WIN-XXXXXXXXXXX
```
pattern signals rushed provisioning → likely default service-account passwords)
Timestamp leak (used in NTLMv2 hash cracking acceleration)
Direct attack-map enrichment for credential spraying combined with
```
hunt-auth-bypass
```
Legacy-Protocol Matrix

NTLM 信息泄露在与上下文串联时属于 中等严重性发现——泄露本身是符合协议的有意行为（符合 RFC 的 NTLMSSP challenge），但在暴露于互联网的企业基础设施上，它会为下一阶段攻击提供精确的侦察信息。价值最高的目标：

互联网可访问且支持 dual-auth 的 IIS / SharePoint / Exchange / OWA（Forms + NTLM，或 NTLM + Kerberos）
互联网侧的 Citrix NetScaler / VMware Horizon View gateway，通过 NTLM 连接 AD auth
Lync / Skype for Business / Teams On-Prem edge server
通过 NTLM 保护管理路径的 WSUS / Windows Update Services
代理 NTLM 的 CIFS-style 文件共享代理（HCL Sametime、IBM Notes Domino）
在 public-zone IIS binding 上仍启用 NTLM 的 legacy SharePoint farm

价值所在：

内部 AD domain 泄露（parent-forest 映射，例如
```
customer.parent-corp.example
```
→ 企业 AD 树内的 tenant）
默认 Windows hostname 泄露（
```
WIN-XXXXXXXXXXX
```
模式表明 provisioning 很仓促 → service account 很可能仍使用默认密码）
Timestamp 泄露（可用于加速 NTLMv2 hash cracking）
与
```
hunt-auth-bypass
```
Legacy-Protocol Matrix 结合后，可直接补全 credential spraying 的 attack map

Attack Surface Signals

攻击面信号

Response headers signaling NTLM availability:

WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM, Negotiate
WWW-Authenticate: Negotiate, NTLM

URL patterns where NTLM is commonly exposed:

/_api/web/CurrentUser                  (SharePoint REST)
/_vti_bin/*.asmx                       (SharePoint legacy SOAP)
/EWS/Exchange.asmx                     (Exchange Web Services)
/Autodiscover/Autodiscover.xml         (Exchange autodiscover)
/owa/                                  (Outlook Web App)
/Microsoft-Server-ActiveSync           (ActiveSync)
/PowerShell                            (Exchange Mgmt Shell over HTTPS)
/api/v3/                               (TeamCity, Atlassian)
/wsus/                                 (Windows Server Update Services)
/manager/html                          (some Tomcat behind IIS)
/iisstart.htm                          (default IIS, sometimes reveals NTLM upstream)

Tech-stack signals:

IIS on the public internet (almost always NTLM-capable, even if Forms is the front)
SharePoint Web Front End (almost always dual-auth Forms + NTLM)
Exchange edge transport

Server header

Microsoft-HTTPAPI/2.0

Microsoft-IIS/*

IIS/*

表明 NTLM 可用的响应标头：

WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM, Negotiate
WWW-Authenticate: Negotiate, NTLM

通常暴露 NTLM 的 URL 模式：

/_api/web/CurrentUser                  (SharePoint REST)
/_vti_bin/*.asmx                       (SharePoint legacy SOAP)
/EWS/Exchange.asmx                     (Exchange Web Services)
/Autodiscover/Autodiscover.xml         (Exchange autodiscover)
/owa/                                  (Outlook Web App)
/Microsoft-Server-ActiveSync           (ActiveSync)
/PowerShell                            (Exchange Mgmt Shell over HTTPS)
/api/v3/                               (TeamCity, Atlassian)
/wsus/                                 (Windows Server Update Services)
/manager/html                          (some Tomcat behind IIS)
/iisstart.htm                          (default IIS, sometimes reveals NTLM upstream)

技术栈信号：

暴露在公共互联网上的 IIS（几乎都支持 NTLM，即使前端使用 Forms）
SharePoint Web Front End（几乎始终支持 Forms + NTLM dual-auth）
Exchange edge transport

Server header

Microsoft-HTTPAPI/2.0

、

Microsoft-IIS/*

、

IIS/*

Step-by-Step Hunting Methodology

逐步检测方法

Probe every anonymous endpoint for
WWW-Authenticate: NTLM
. Send a vanilla GET and inspect response headers. If NTLM is offered, proceed.

Send a valid NTLMSSP Type-1 message anonymously. The Type-1 base64 below requests NetBIOS-domain and Workstation info from the server:

Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==

This is the standard test Type-1 with negotiate flags

NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_NEGOTIATE_56 | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_TARGET_INFO

. The

OS Version

field (

06 01 B1 1D 00 00 00 0F

) is Windows 7 build 7601 — accepted by virtually every NTLM responder.

Use a keep-alive raw socket, not Python requests / curl one-shot. Most HTTP libraries close the connection between the Type-1 send and Type-2 reception. Use one of:
- Burp Repeater with
```
Connection: keep-alive
```
  set explicitly
- Burp
```
mcp__burp__send_http1_request
```
  (handles keep-alive natively)
- Python raw
```
socket
```
  +
```
ssl.wrap_socket
```
  (see Payload section)
Parse the Type-2 challenge from the
WWW-Authenticate: NTLM <base64>
response header. Base64-decode the value. The structure is NTLMSSP per MS-NLMP:
- Bytes 0-7: literal
```
NTLMSSP\0
```
- Bytes 8-11: MessageType =
```
\x02\x00\x00\x00
```
- Bytes 12-19: TargetName SecurityBuffer (len, alloc, offset)
- Bytes 20-23: NegotiateFlags
- Bytes 24-31: Server Challenge (8 bytes — useful for offline cracking)
- Bytes 40-47: TargetInfo SecurityBuffer (len, alloc, offset)
- TargetInfo body:
```
AV_PAIRS
```
  array of (AvId u16, AvLen u16, Value)
Decode the AV_PAIRS. The AvIds you care about:
- ```
1
```
  = NetBIOS Computer Name
- ```
2
```
  = NetBIOS Domain Name
- ```
3
```
  = DNS Computer Name (FQDN of the responding server)
- ```
4
```
  = DNS Domain Name (the AD domain)
- ```
5
```
  = DNS Tree Name (the AD forest root)
- ```
7
```
  = Timestamp (FILETIME, useful for NTLMv2 hash relay / cracking)
- ```
9
```
  = Target Name (in newer NTLMSSP)
Map findings to severity tier:
- Internet-exposed + default
```
WIN-XXXXXXXXXXX
```
  hostname + corporate-AD-tree disclosure → Medium
- Internet-exposed + named-server hostname (
```
SPWEB01.corp.example
```
  ) + corporate-AD-tree → Low-Medium
- Intranet-only + any disclosure → Informational
- Combine with
```
hunt-auth-bypass
```
  Legacy-Protocol Matrix findings on the same host → upgrade the auth-bypass finding's severity since the attacker has UPN/SAM format ready
Check the timestamp. If
```
AV[7]
```
returns a current FILETIME within ~5s of
```
Date:
```
header, the system clock is synced — useful intel for Kerberos golden-ticket forging (out of bug-bounty scope but red-team relevant).
Cross-reference with subdomain enum. The DNS Tree name often reveals the parent forest — e.g.
```
customer.parent-corp.example
```
reveals the customer is a sub-domain INSIDE corporate-parent AD, not a separate tenant. This is a privacy / topology-disclosure escalation that programs sometimes accept as Medium.

探测每个允许匿名访问的 endpoint，检查
WWW-Authenticate: NTLM
。发送普通 GET 并检查 response header。如果提供 NTLM，则继续。

匿名发送有效的 NTLMSSP Type-1 消息。 下方 Type-1 base64 会向服务器请求 NetBIOS-domain 和 Workstation 信息：

Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==

这是带有 negotiate flags

NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_NEGOTIATE_56 | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_TARGET_INFO

的标准测试 Type-1。

OS Version

字段（

06 01 B1 1D 00 00 00 0F

）对应 Windows 7 build 7601，几乎所有 NTLM responder 都能接受。

使用 keep-alive raw socket，不要使用 Python requests / curl one-shot。 大多数 HTTP library 会在发送 Type-1 与接收 Type-2 之间关闭连接。可选方案：
- 显式设置
```
Connection: keep-alive
```
  的 Burp Repeater
- Burp
```
mcp__burp__send_http1_request
```
  （原生支持 keep-alive）
- Python raw
```
socket
```
  +
```
ssl.wrap_socket
```
  （见 Payload 部分）
从
WWW-Authenticate: NTLM <base64>
response header 中解析 Type-2 challenge。对 value 进行 Base64 decode。根据 MS-NLMP，其结构为 NTLMSSP：
- Bytes 0-7：字面量
```
NTLMSSP\0
```
- Bytes 8-11：MessageType =
```
\x02\x00\x00\x00
```
- Bytes 12-19：TargetName SecurityBuffer（len、alloc、offset）
- Bytes 20-23：NegotiateFlags
- Bytes 24-31：Server Challenge（8 bytes，可用于 offline cracking）
- Bytes 40-47：TargetInfo SecurityBuffer（len、alloc、offset）
- TargetInfo body：由
```
(AvId u16, AvLen u16, Value)
```
  组成的
```
AV_PAIRS
```
  数组
解码 AV_PAIRS。 需要关注的 AvId：
- ```
1
```
  = NetBIOS Computer Name
- ```
2
```
  = NetBIOS Domain Name
- ```
3
```
  = DNS Computer Name（响应服务器的 FQDN）
- ```
4
```
  = DNS Domain Name（AD domain）
- ```
5
```
  = DNS Tree Name（AD forest root）
- ```
7
```
  = Timestamp（FILETIME，可用于 NTLMv2 hash relay / cracking）
- ```
9
```
  = Target Name（较新的 NTLMSSP 中）
将发现映射到严重性等级：
- Internet-exposed + 默认
```
WIN-XXXXXXXXXXX
```
  hostname + corporate-AD-tree 泄露 → Medium
- Internet-exposed + 具名服务器 hostname（
```
SPWEB01.corp.example
```
  ）+ corporate-AD-tree → Low-Medium
- 仅限内网 + 任意信息泄露 → Informational
- 同一 host 上结合
```
hunt-auth-bypass
```
  Legacy-Protocol Matrix 的发现 → 提升 auth-bypass finding 的严重性，因为攻击者已经掌握 UPN/SAM format
检查 timestamp。 如果
```
AV[7]
```
返回与
```
Date:
```
header 相差约 5 秒以内的当前 FILETIME，说明系统时钟已同步；这有助于进行 Kerberos golden-ticket forging（超出 bug-bounty 范围，但与 red-team 相关）。
与 subdomain enum 交叉验证。 DNS Tree name 经常揭示 parent forest——例如
```
customer.parent-corp.example
```
表明 customer 是 corporate-parent AD 内部的 child domain，而不是独立 tenant。这属于隐私 / topology disclosure 升级，有些项目会将其评为 Medium。

Payload & Detection Patterns

Payload 与检测模式

Generic NTLM Type-1 anonymous probe (curl + raw socket fallback):

bash

undefined

通用 NTLM Type-1 匿名探测（curl + raw socket fallback）：

bash

undefined

Most one-shot curl runs DON'T return Type-2 because the connection closes.

Use this as a quick probe to confirm NTLM is offered:

curl -sk -I -H "Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw=="
"https://target.example/_api/web/CurrentUser" 2>&1 | grep -i "WWW-Authenticate"


**Burp `send_http1_request` (recommended for full Type-2 capture):**

GET /_api/web/CurrentUser HTTP/1.1 Host: target.example Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw== Connection: keep-alive User-Agent: Mozilla/5.0


**Python raw socket + AV_PAIR decoder:**
```python
import socket, ssl, base64, struct, re
from datetime import datetime, timezone

HOST = "target.example"
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

s = ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)
s.sendall(
    f"GET /_api/web/CurrentUser HTTP/1.1\r\n"
    f"Host: {HOST}\r\n"
    "Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\r\n"
    "User-Agent: Mozilla/5.0\r\nConnection: keep-alive\r\n\r\n".encode()
)
data = b""
while True:
    chunk = s.recv(8192)
    if not chunk: break
    data += chunk
    if b"\r\n\r\n" in data: break

m = re.search(rb"WWW-Authenticate:\s*NTLM\s+([A-Za-z0-9+/=]{20,})", data, re.I)
if m:
    b = base64.b64decode(m.group(1).decode("ascii"))
    assert b[:8] == b"NTLMSSP\x00"
    tn_len, _, tn_off = struct.unpack_from('<HHI', b, 12)
    ti_len, _, ti_off = struct.unpack_from('<HHI', b, 40)
    print(f"TargetName: {b[tn_off:tn_off+tn_len].decode('utf-16-le', errors='ignore')!r}")
    av_types = {1:'NetBIOS Computer Name', 2:'NetBIOS Domain Name',
                3:'DNS Computer Name', 4:'DNS Domain Name',
                5:'DNS Tree Name', 7:'Timestamp', 9:'Target Name'}
    i = 0
    ti = b[ti_off:ti_off+ti_len]
    while i < len(ti):
        av_id, av_len = struct.unpack_from('<HH', ti, i)
        if av_id == 0: break
        val = ti[i+4:i+4+av_len]
        if av_id == 7:
            ts = struct.unpack('<Q', val[:8])[0]
            secs = (ts - 116444736000000000) / 10000000
            vs = datetime.fromtimestamp(secs, tz=timezone.utc).isoformat()
        else:
            vs = val.decode('utf-16-le', errors='ignore')
        print(f"  AV[{av_id}] {av_types.get(av_id, '?'):28s}: {vs!r}")
        i += 4 + av_len

Burp Collaborator NOT needed for this finding class — the data leak is in the synchronous response, not via OOB.

curl -sk -I -H "Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw=="
"https://target.example/_api/web/CurrentUser" 2>&1 | grep -i "WWW-Authenticate"


**Burp `send_http1_request`（推荐用于完整捕获 Type-2）：**

GET /_api/web/CurrentUser HTTP/1.1 Host: target.example Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw== Connection: keep-alive User-Agent: Mozilla/5.0


**Python raw socket + AV_PAIR decoder：**
```python
import socket, ssl, base64, struct, re
from datetime import datetime, timezone

HOST = "target.example"
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

s = ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)
s.sendall(
    f"GET /_api/web/CurrentUser HTTP/1.1\r\n"
    f"Host: {HOST}\r\n"
    "Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\r\n"
    "User-Agent: Mozilla/5.0\r\nConnection: keep-alive\r\n\r\n".encode()
)
data = b""
while True:
    chunk = s.recv(8192)
    if not chunk: break
    data += chunk
    if b"\r\n\r\n" in data: break

m = re.search(rb"WWW-Authenticate:\s*NTLM\s+([A-Za-z0-9+/=]{20,})", data, re.I)
if m:
    b = base64.b64decode(m.group(1).decode("ascii"))
    assert b[:8] == b"NTLMSSP\x00"
    tn_len, _, tn_off = struct.unpack_from('<HHI', b, 12)
    ti_len, _, ti_off = struct.unpack_from('<HHI', b, 40)
    print(f"TargetName: {b[tn_off:tn_off+tn_len].decode('utf-16-le', errors='ignore')!r}")
    av_types = {1:'NetBIOS Computer Name', 2:'NetBIOS Domain Name',
                3:'DNS Computer Name', 4:'DNS Domain Name',
                5:'DNS Tree Name', 7:'Timestamp', 9:'Target Name'}
    i = 0
    ti = b[ti_off:ti_off+ti_len]
    while i < len(ti):
        av_id, av_len = struct.unpack_from('<HH', ti, i)
        if av_id == 0: break
        val = ti[i+4:i+4+av_len]
        if av_id == 7:
            ts = struct.unpack('<Q', val[:8])[0]
            secs = (ts - 116444736000000000) / 10000000
            vs = datetime.fromtimestamp(secs, tz=timezone.utc).isoformat()
        else:
            vs = val.decode('utf-16-le', errors='ignore')
        print(f"  AV[{av_id}] {av_types.get(av_id, '?'):28s}: {vs!r}")
        i += 4 + av_len

此 finding 类型不需要 Burp Collaborator——数据泄露发生在同步 response 中，而非通过 OOB。

Common Root Causes

常见根因

Dual-auth IIS bindings on the public zone. Administrators leave NTLM enabled on the public-facing IIS site even when Forms auth is the intended entry point. Internal users get SSO; external attackers get the AD topology leak.
Default IIS Application Pool identity left as
ApplicationPoolIdentity
. Combined with default hostname, signals provisioning never went past first-boot.
Server never renamed from Windows-installer-generated hostname. Microsoft's default
```
WIN-XXXXXXXXXXX
```
11-character pattern is the immediate tell. Sometimes also
```
WORKGROUP\WIN-...
```
in older boxes.
Sub-domain joined to corporate forest without zone-isolation. European-integrator case: a a European importer's SharePoint test environment is a child domain inside a corporate global AD, disclosed via NTLM DNS Tree Name. The customer probably intends
```
customer.parent-corp.example
```
to be operationally separate but the NTLM Type-2 reveals the forest membership to anyone who probes.
IIS Extended Protection NOT enabled. When
```
<system.webServer><security><authentication><windowsAuthentication extendedProtection>
```
is
```
None
```
(the default), the NTLM challenge is sent to any anonymous client. When set to
```
Required
```
, NTLM is restricted to authenticated callers — and the AV-pair leak is mitigated.
No
WindowsAuthentication
removed from
applicationHost.config
for internet-exposed sites. SharePoint Central Admin sometimes leaves this enabled even when SP zone configuration only enables Forms.

公共区域的 IIS dual-auth binding。 管理员即使打算以 Forms auth 作为入口，仍在 public-facing IIS site 上保留 NTLM。内部用户获得 SSO；外部攻击者则获得 AD topology 泄露。
默认 IIS Application Pool identity 仍为
ApplicationPoolIdentity
。结合默认 hostname，表明 provisioning 从未越过首次启动阶段。
Server 从未从 Windows installer 生成的 hostname 重命名。 Microsoft 默认的
```
WIN-XXXXXXXXXXX
```
11 字符模式是最直接的信号。旧机器上有时还会出现
```
WORKGROUP\WIN-...
```
。
子域加入 corporate forest 时未进行 zone isolation。 欧洲集成商案例：某欧洲进口商的 SharePoint 测试环境是 global AD 内的 child domain，并通过 NTLM DNS Tree Name 泄露。客户可能认为
```
customer.parent-corp.example
```
在运营上彼此独立，但 NTLM Type-2 会向任何探测者揭示 forest membership。
IIS Extended Protection 未启用。 当
```
<system.webServer><security><authentication><windowsAuthentication extendedProtection>
```
为
```
None
```
（默认值）时，NTLM challenge 会发送给任何匿名客户端。设为
```
Required
```
后，NTLM 仅限 authenticated caller 使用，AV-pair leak 也会得到缓解。
未从互联网暴露站点的
applicationHost.config
中移除
WindowsAuthentication
。即使 SP zone configuration 仅启用 Forms，SharePoint Central Admin 有时仍会保留此设置。

Bypass Techniques

绕过技术

This skill describes a disclosure leak, not an authentication bypass. The "bypass" question is: how do defenders block this AV-pair leak while still allowing legitimate NTLM auth?

Defense	Effectiveness
Disable NTLM on the public IIS binding entirely (Forms-only)	Best — eliminates the surface
IIS Extended Protection = Required	Restricts NTLM challenge to authenticated callers; AV-pair leak mitigated
Reverse-proxy strip `WWW-Authenticate` from anonymous responses	Sometimes works but breaks legitimate clients
Rate-limit the Type-1 → Type-2 endpoint	Doesn't prevent disclosure, only slows enumeration
Rename the Windows host from `WIN-XXXXXXXXXXX`	Removes the "lazy provisioning" tell; doesn't stop the leak
Move the SP/Exchange farm to a child AD with no cross-trust to corporate	Mitigates the forest disclosure; doesn't stop the leak

For the attacker: there's no "bypass" needed — the leak is the finding.

本 skill 描述的是 disclosure leak，而不是 authentication bypass。“bypass”问题在于：防守方如何阻止 AV-pair leak，同时仍允许合法的 NTLM auth？

防御措施	有效性
在 public IIS binding 上完全禁用 NTLM（仅使用 Forms）	最佳——消除攻击面
IIS Extended Protection = Required	将 NTLM challenge 限制给 authenticated caller；缓解 AV-pair leak
由 reverse proxy 移除匿名 response 中的 `WWW-Authenticate`	有时有效，但会破坏合法客户端
对 Type-1 → Type-2 endpoint 进行 rate limit	无法阻止 disclosure，只会减慢 enumeration
将 Windows host 从 `WIN-XXXXXXXXXXX` 重命名	移除“provisioning 草率”的信号，但不会停止泄露
将 SP/Exchange farm 迁移到不与 corporate AD 存在 cross-trust 的 child AD	缓解 forest disclosure，但不会停止泄露

对于攻击者：不需要任何“绕过”——泄露本身就是 finding。

Gate 0 Validation

Gate 0 验证

Before writing the report, confirm:

What can the attacker do RIGHT NOW with this disclosure?
- Internet-exposed + default hostname + corporate forest disclosed → Medium: attacker has UPN format for
```
hunt-auth-bypass
```
  matrix probes, plus knows server has likely-default service accounts.
- Intranet-only or only NetBIOS name → Informational.
Does the program accept information-disclosure findings without a chained impact?
- Many programs (Microsoft, large enterprise VDPs) DO accept this when the leaked info includes internal AD topology.
- Many programs (Shopify, GitHub) reject info disclosure without a chained impact.
- Read the program scope before submitting; if borderline, chain with a Tier-A finding from
```
hunt-auth-bypass
```
  .
Can you reproduce in <5 minutes from a fresh shell?
- The Python snippet above is the canonical reproduction. Include it verbatim in the report.

在撰写报告前，确认：

攻击者此刻就能利用这项披露做什么？
- Internet-exposed + 默认 hostname + corporate forest 泄露 → Medium：攻击者已经拥有
```
hunt-auth-bypass
```
  matrix probe 所需的 UPN format，也知道 server 很可能使用默认 service account。
- 仅限 Intranet，或只泄露 NetBIOS name → Informational。
项目是否接受没有 chained impact 的 information-disclosure finding？
- 许多 program（Microsoft、大型企业 VDP）确实会在泄露信息包含 internal AD topology 时接受此类发现。
- 许多 program（Shopify、GitHub）不接受没有 chained impact 的 information disclosure。
- 提交前先阅读 program scope；如果处于边界情况，可与
```
hunt-auth-bypass
```
  的 Tier-A finding 串联。
能否在全新 shell 中于 <5 分钟内复现？
- 上面的 Python snippet 是标准复现方式。报告中应原样包含。

Real Impact Examples

真实影响示例

Scenario A — Enterprise SharePoint inside parent corporate AD

场景 A — 位于父级 corporate AD 内的 Enterprise SharePoint

Target:

https://target-portal.example/

— a enterprise dealer portal (test mirror) operated by a system integrator.

Sending the anonymous Type-1 message to

/_api/web/CurrentUser

returned a Type-2 challenge whose AV_PAIRS decoded to:

NetBIOS Domain Name:    <CustomerName>
NetBIOS Computer Name:  WIN-XXXXXXXXXXX
DNS Domain Name:        customer.parent-corp.example
DNS Computer Name:      WIN-XXXXXXXXXXX.customer.parent-corp.example
DNS Tree Name:          customer.parent-corp.example
Timestamp:              2026-05-13T15:55:37.922Z

Three escalation paths:

Default Windows-installer hostname (
WIN-XXXXXXXXXXX
) — server was never renamed after OS install; strong signal of lazy provisioning. Likely default service-account passwords on the SQL backend, default WSUS config, etc.
Sub-domain inside corporate-parent AD (
customer.parent-corp.example
) — the customer is a child domain inside <ParentCorp>'s global Active Directory. A compromise of this test farm has potential cross-trust to corporate-parent.
UPN format known — combined with
```
hunt-auth-bypass
```
's discovery of an anonymous brute-force endpoint on
```
/_vti_bin/Authentication.asmx
```
, the attacker has both the credential format (
```
firstname.lastname@customer.parent-corp.example
```
or
```
<CustomerName>\firstname.lastname
```
) and the unlimited submission endpoint.

Reported severity: Medium, with a note that the chain with the Authentication.asmx anonymous brute-force makes the combined attack Critical.

Target：

https://target-portal.example/

——由 system integrator 运营的企业 dealer portal（测试镜像）。

向

/_api/web/CurrentUser

发送匿名 Type-1 消息后，返回了 Type-2 challenge，其 AV_PAIRS 解码结果如下：

NetBIOS Domain Name:    <CustomerName>
NetBIOS Computer Name:  WIN-XXXXXXXXXXX
DNS Domain Name:        customer.parent-corp.example
DNS Computer Name:      WIN-XXXXXXXXXXX.customer.parent-corp.example
DNS Tree Name:          customer.parent-corp.example
Timestamp:              2026-05-13T15:55:37.922Z

有三条升级路径：

默认 Windows-installer hostname（
WIN-XXXXXXXXXXX
）——OS install 后 server 从未 rename；这是 provisioning 仓促完成的强烈信号。SQL backend 上的 service account 很可能仍使用默认密码，也可能存在默认 WSUS 配置等问题。
位于 corporate-parent AD 内的子域（
customer.parent-corp.example
）——customer 是 global Active Directory 中 <ParentCorp> 的 child domain。该测试 farm 一旦失守，就可能通过 cross-trust 波及 corporate parent。
已知 UPN format——结合
```
hunt-auth-bypass
```
在
```
/_vti_bin/Authentication.asmx
```
上发现的匿名 brute-force endpoint，攻击者既掌握 credential format（
```
firstname.lastname@customer.parent-corp.example
```
或
```
<CustomerName>\firstname.lastname
```
），也掌握了 unlimited submission endpoint。

报告严重性：Medium，并说明与 Authentication.asmx 匿名 brute-force 串联后，组合攻击达到 Critical。

Scenario B — Exchange edge with NTLM-protected EWS

场景 B — 使用 NTLM 保护 EWS 的 Exchange edge

Target:

https://mail.example.com/EWS/Exchange.asmx

. Type-1 probe returns Type-2 with DNS Tree Name

corp.example.com

and DNS Computer Name

MAIL01.corp.example.com

. Confirms the Exchange edge is domain-joined to corporate AD (rather than running in a DMZ-isolated AD). For an attacker with the matching

hunt-mfa-bypass

hunt-auth-bypass

chain, the leaked UPN format and server-name format accelerate credential spraying by removing the recon step. Reported severity: Low-Medium depending on program.

Target：

https://mail.example.com/EWS/Exchange.asmx

。Type-1 probe 返回 Type-2，其中 DNS Tree Name 为

corp.example.com

，DNS Computer Name 为

MAIL01.corp.example.com

。这确认 Exchange edge 已加入 corporate AD，而不是运行在 DMZ-isolated AD 中。对于已经掌握匹配

hunt-mfa-bypass

hunt-auth-bypass

chain 的攻击者，泄露的 UPN format 和 server-name format 可以省去 recon 步骤，从而加速 credential spraying。报告严重性：根据项目定为 Low-Medium。

Scenario C — Intranet-only intentional leak (not a finding)

场景 C — 仅限内网的预期泄露（不是 finding）

Target:

https://intranet.corp.example

(clearly internal, behind VPN). Type-1 returns full AV-pair set. Not reportable — this is intended NTLM behavior on intranet, and the disclosure is to authenticated VPN users who already see the same data via

nltest /dsgetdc:corp.example.com

. Recognize and drop.

Target：

https://intranet.corp.example

（显然属于内部，位于 VPN 后）。Type-1 返回完整的 AV-pair set。不可报告——这是 intranet 上预期的 NTLM behavior，泄露对象是已通过 VPN 认证的用户，他们本来就能通过

nltest /dsgetdc:corp.example.com

看到相同数据。识别后直接丢弃。

hunt-ntlm-info

Original

Translation

Crown Jewel Targets

核心高价值目标

Attack Surface Signals

攻击面信号

Step-by-Step Hunting Methodology

逐步检测方法

Payload & Detection Patterns

Payload 与检测模式

Most one-shot curl runs DON'T return Type-2 because the connection closes.

Most one-shot curl runs DON'T return Type-2 because the connection closes.

Use this as a quick probe to confirm NTLM is offered:

Use this as a quick probe to confirm NTLM is offered:

Common Root Causes

常见根因

Bypass Techniques

绕过技术

Gate 0 Validation

Gate 0 验证

Real Impact Examples

真实影响示例

Scenario A — Enterprise SharePoint inside parent corporate AD

场景 A — 位于父级 corporate AD 内的 Enterprise SharePoint

Scenario B — Exchange edge with NTLM-protected EWS

场景 B — 使用 NTLM 保护 EWS 的 Exchange edge

Scenario C — Intranet-only intentional leak (not a finding)

场景 C — 仅限内网的预期泄露（不是 finding）

Related Skills & Chains

相关 Skill 与串联链路