diff options
| author | Jon Cave <jon.cave@mwrinfosecurity.com> | 2016-07-23 11:04:16 +0100 |
|---|---|---|
| committer | Jon Cave <jon.cave@mwrinfosecurity.com> | 2016-07-23 11:04:16 +0100 |
| commit | 892492e2aa1b71bbb9607973d322bad7cc2028d0 (patch) | |
| tree | d28f91235b6ca20caf8fd9e31e040ce88b3e095a /Scripts/Inveigh-BruteForce.ps1 | |
| parent | f25dd5475e4b84a62aa7df62d9d4a6ad4fe498ba (diff) | |
| download | Inveigh-892492e2aa1b71bbb9607973d322bad7cc2028d0.tar.gz Inveigh-892492e2aa1b71bbb9607973d322bad7cc2028d0.zip | |
Correctly parse SMB NTLMSSP messages
Decide on NTLMv1 vs. NTLMv2 by inspecting the length of the NTLM
response data, not by the presence of LM data. Prior to the patch, if
an LMv2 response was included, Inveigh would output a badly formatted
hash calling it 'NTLMv1'.
Use all four bytes for offset data (just in case).
Simplify string extraction by requiring the use of an offset. Always
used the offsets from the message header instead of assuming a certain
content ordering.
Diffstat (limited to 'Scripts/Inveigh-BruteForce.ps1')
0 files changed, 0 insertions, 0 deletions