mandiant-gopacket

mirror of https://github.com/mandiant/gopacket synced 2026-06-21 13:57:02 +00:00

Files

T

Jacob Paullus 8cdb67a92d smb2: support true anonymous (null session) NTLM bind

Allow NTLMInitiator with empty User/Password/Hash to establish an SMB
anonymous (null) session instead of refusing at dial time.

- client.go: drop the dial-time guard that rejected empty-user NTLM
  initiators outright.
- internal/ntlm/client.go: add an anonymous AUTHENTICATE branch per
  [MS-NLMP] 3.1.5.1.2 -- empty NtChallengeResponse, a single 0x00 byte
  LmChallengeResponse, NTLMSSP_ANONYMOUS set, no MIC and no session key.
  DomainName/UserName/Workstation are forced empty and the signing,
  sealing and key-exchange flags are cleared (leaving KEY_EXCH set with a
  zero-length EncryptedRandomSessionKey makes strict servers such as Samba
  reject the bind with STATUS_INVALID_PARAMETER).
- initiator.go: nil-guard Sum/SessionKey/infoMap so the keyless anonymous
  path cannot panic.

Verified against Samba: a server permitting null sessions accepts the
bind (logged as ANONYMOUS LOGON, S-1-5-7) and lists shares; a server with
restrict anonymous=2 fails gracefully via os.ErrPermission; authenticated
binds are unchanged.

2026-06-08 15:30:11 -05:00

dcerpc

drsuapi: drop writeDSNAME structLen +2 cargo-cult

2026-05-12 18:26:55 -05:00

dpapi

Initial commit

2026-04-17 14:20:41 -05:00

dpaping

module: rename to github.com/mandiant/gopacket

2026-04-22 10:27:18 -05:00

ese

Initial commit