[Feature Request] Add ability to authenticate via NTHASH

[r3pek]

small feature request for "Quality of Life" :)

[g0h4n]

Yes, this feature would be ideal 🔥 , but I'm dependent on ldap3 rust.
It should be possible to implement it.
If anyone would like to attempt it, it would be a great help 🙏

I'll take a look on my side

[z-jxy]

Since it's unclear whether ldap3 crate will add support for this, I'm going to create a fork and implement it.

Did some work on this already and was able to get a basic example working:

let mut ldap = LdapConn::new("ldap://localhost:389")?;
let ntlm_hash = "5B4C6335673A75F13ED948E848F00840";
let res = ldap.sasl_ntlmv1_bind("user", "testing.local", &hex::decode(ntlm_hash).unwrap())?;
if res.rc == 0 {
    println!("NTLM hash authentication successful");
    let (entries, _) = ldap.search(
        "dc=testing,dc=local",
        ldap3::Scope::Subtree,
        "(objectClass=person)",
        vec!["cn", "name"]
    )?.success()?;
    println!("Entries: {:?}", entries.len());
}

[*] Starting NTLM bind
First NTLM response: rc=14, text=""
Server challenge: [2f, e1, af, 0c, 7d, 5d, 98, ea]
NTLM hash: 5b4c6335673a75f13ed948e848f00840
Challenge: 2fe1af0c7d5d98ea
DES Key1: 5aa618665638e8ea
DES Key2: f09eb6288e4222e0
DES Key3: 0820000000000000
DES Block1: e73e4fc722809494
DES Block2: b52107c1d4014e10
DES Block3: d9b8eeb12c0e4cee
Final NTLM response: e73e4fc722809494b52107c1d4014e10d9b8eeb12c0e4cee
NTLM hash authentication successful
Entries: 25

Implementation is still pretty rough; I'll submit a PR to use my forked version once its ready

[g0h4n]

Thanks a lot for digging into this and getting a working example @z-jxy! Really cool to see ldap.sasl_ntlmv1_bind() functional with an NT hash! 🔥

If you end up with a stable version in your fork, it would be awesome to see you submit a PR to ldap3 as well. (inejge/ldap3#140)

Looking forward to testing your fork once the PR is up! Let me know if I can help validate anything.

[g0h4n]

Thanks @z-jxy for your contribution to adding NT hash authentication! #17 🔥

[g0h4n]

Pass The Hash authentication available in this branch: https://github.com/g0h4n/RustHound-CE/tree/feat/ntlm-support

[g0h4n]

Hello,

I’m reopening this issue since the pull requests from @z-jxy are currently under review on the sspi-rs and ldap3 dependencies.

Once the dependencies are validated, we will be able to add a stable implementation to the main branch of RustHound-CE.
Thanks again @z-jxy! 🔥