Script `smtp-ntlm-info`

Script types: portrule
Categories: default, discovery, safe
Download: https://svn.nmap.org/nmap/scripts/smtp-ntlm-info.nse

Script Summary

This script enumerates information from remote SMTP services with NTLM authentication enabled.

Sending a SMTP NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version.

Script Arguments

smtp.domain: See the documentation for the smtp library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.

Example Usage

nmap -p 25,465,587 --script smtp-ntlm-info --script-args smtp-ntlm-info.domain=domain.com <target>

Script Output

25/tcp   open     smtp
| smtp-ntlm-info:
|   Target_Name: ACTIVESMTP
|   NetBIOS_Domain_Name: ACTIVESMTP
|   NetBIOS_Computer_Name: SMTP-TEST2
|   DNS_Domain_Name: somedomain.com
|   DNS_Computer_Name: smtp-test2.somedomain.com
|   DNS_Tree_Name: somedomain.com
|_  Product_Version: 6.1.7601

Requires

Author:

Justin Cacak