Hunt Ntlm Info
Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange.
Install
npx skills add Zyrexnn/Cybermes --skill hunt-ntlm-info -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Engineering
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.
Crown Jewel Targets
NTLM info disclosure is a Medium-severity finding when chained to context, the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:
- Internet-reachable IIS / SharePoint / Exchange / OWA with dual-auth (Forms + NTLM, or NTLM + Kerberos)
- Citrix NetScaler / VMware Horizon View internet-facing gateways with NTLM-backed AD auth
- Lync / Skype for Business / Teams On-Prem edge servers
- WSUS / Windows Update Services with NTLM-protected admin paths
- CIFS-style fileshare proxies (HCL Sametime, IBM Notes Domino) that proxy NTLM
- Legacy SharePoint farms that left NTLM enabled on the public-zone IIS binding
What makes this pay:
- Internal AD domain disclosure (parent-forest mapping, e.g.
customer.parent-corp.example→ tenant inside corporate-AD tree) - Default-Windows-hostname disclosure (
WIN-XXXXXXXXXXXpattern signals rushed provisioning → likely default service-account passwords) - Timestamp leak (used in NTLMv2 hash cracking acceleration)
- Direct attack-map enrichment for credential spraying combined with
hunt-auth-bypassLegacy-Protocol Matrix
Attack Surface Signals
Response headers signaling NTLM availability:
WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM, Negotiate
WWW-Authenticate: Negotiate, NTLM
