id: ntlm-directories

info:
  name: Discovering directories w/ NTLM
  author: puzzlepeaches,incogbyte
  severity: info
  reference:
    - https://medium.com/swlh/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666
  metadata:
    max-request: 47
  tags: misc,fuzz,windows

http:
  - raw:
      - |
        GET {{path}} HTTP/1.1
        Host: {{Hostname}}
        Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=

    threads: 10
    payloads:
      path:
        - /
        - /abs/
        - /ecp/
        - /etc/
        - /ews/
        - /mcx/
        - /oab/
        - /owa/
        - /rgs/
        - /rpc/
        - /conf/
        - /meet/
        - /ocsp/
        - /ucwa/
        - /adfs/
        - /dialin/
        - /public/
        - /certsrv/
        - /exchweb/
        - /meeting/
        - /certprov/
        - /exchange/
        - /scheduler/
        - /webticket/
        - /autoupdate/
        - /certenroll/
        - /powershell/
        - /rgsclients/
        - /rpcwithcert/
        - /autodiscover/
        - /hybridconfig/
        - /reach/sip.svc
        - /aspnet_client/
        - /groupexpansion/
        - /persistentchat/
        - /requesthandler/
        - /unifiedmessaging/
        - /mcx/mcxservice.svc
        - /phoneconferencing/
        - /requesthandlerext/
        - /deviceupdatefiles_ext/
        - /deviceupdatefiles_int/
        - /microsoft-server-activesync/
        - /webticket/webticketservice.svc
        - /webticket/webticketservice.svcabs/
        - /adfs/services/trust/2005/windowstransport
        - /internal_windows_authentication/

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(header), 'www-authenticate: ntlm')"

      - type: status
        status:
          - 401

    extractors:
      - type: kval
        kval:
          - 'www_authenticate'

# digest: 490a00463044022013442553fdd26776dbf5dcca72bb0bed830d4a69572a49f2795a985bf1ab60990220481c7641599f24237e5269ac264e35eee782eb5aaae9b05c3515f38f563a6dc2:922c64590222798bb761d5b6d8e72950