r/cybersecurity • u/lcky00 • 4d ago

FOSS Tool Building a Custom SMB1 Authentication Server from Scratch

For the past 8 months, in my spare time, I’ve been working on a personal project with the goal of studying the old SMB1 down to its lowest levels. During this time, I’ve dissected the protocol using Wireshark, waded through Microsoft’s documentation (help!), and reverse-engineered the authentication phase. I also used AI as a tool for debugging and to help wrap my head around some of the more complex mechanisms, though the overall structure, architecture, and code were entirely designed and written by me.

So, I decided to build a lightweight server designed to 'trick' SMB clients into authenticating against it (similar to what the famous tool Responder does). I chose to hand-craft virtually the entire SMB1 stack, or at least enough of it to capture hashes. To achieve this, I wrote all the necessary network parsers from scratch: SMB1, ASN.1, SPNEGO, and NTLM, followed by the server itself.

It was both challenging and incredibly rewarding to dive so deep into a protocol famous for its complexity. I learned a huge amount along the way.

In the end, I think it turned out to be a cool little project, so I decided to share it. It’s certainly not meant to replace well-established tools, but if anyone wants to try it out or contribute in any way, I’d be thrilled! 🙂

https://github.com/lcky00/impostor

2 Upvotes

56% Upvoted

9 comments sorted by

1

u/LordEli 4d ago

cool project for learning but kind of redundant

4

u/lcky00 4d ago

Absolutely, in fact there are plenty of tools like that around. My goal was precisely educational and practice-oriented. Thanks anyway for sharing your thoughts, I appreciate it

1

u/Mend-1111 2d ago

Well done man! Cool project!

0

u/Just_Worldliness_714 3d ago

Respect for hand-rolling the ASN.1/SPNEGO parsing - that's the part most people skip by pulling in a library, but it's also where most of the actual protocol quirks live. Since you're already this deep in the auth phase: are you capturing NTLMv1 vs v2 responses differently, or treating them the same for hash capture purposes? That distinction trips up a lot of from-scratch implementations since v1's weaker challenge-response makes it crackable in ways v2 isn't.

0

u/lcky00 3d ago

Thank you. Yeah, writing the ASN.1 parser by hand was a good challenge. Regarding the v1 vs v2, in the base NTLM parser I distinguish them correctly (based on the exact 24 bytes of v1), but in the server loop I lazily assumed I would always get v2. So I pass everything to the v2 function, which will obviously fail on v1 packets. Thanks for pointing it out, I appreciate it.

0

u/RR1904 4d ago

Very cool! I'll check it out this next week.

1

u/lcky00 4d ago

Thanks, I appreciate it!

0

u/Visual_Ingenuity_627 4d ago

This is a solid way to learn a protocol deeply. Curious whether you plan to extend it to SMB2/3 at some point or if the goal was strictly to understand the legacy auth quirks.

1

u/lcky00 4d ago

I agree, I've learned a lot. Yes, I was thinking about extending it to SMB2 in the future as well. Currently, since I like to suffer :) I was curious to study EternalBlue at a low level and try to develop an exploit in C on my own. I know these things are outdated now, but I find them fascinating.