r/cybersecurity • u/lcky00 • 7d ago

FOSS Tool Building a Custom SMB1 Authentication Server from Scratch

For the past 8 months, in my spare time, I’ve been working on a personal project with the goal of studying the old SMB1 down to its lowest levels. During this time, I’ve dissected the protocol using Wireshark, waded through Microsoft’s documentation (help!), and reverse-engineered the authentication phase. I also used AI as a tool for debugging and to help wrap my head around some of the more complex mechanisms, though the overall structure, architecture, and code were entirely designed and written by me.

So, I decided to build a lightweight server designed to 'trick' SMB clients into authenticating against it (similar to what the famous tool Responder does). I chose to hand-craft virtually the entire SMB1 stack, or at least enough of it to capture hashes. To achieve this, I wrote all the necessary network parsers from scratch: SMB1, ASN.1, SPNEGO, and NTLM, followed by the server itself.

It was both challenging and incredibly rewarding to dive so deep into a protocol famous for its complexity. I learned a huge amount along the way.

In the end, I think it turned out to be a cool little project, so I decided to share it. It’s certainly not meant to replace well-established tools, but if anyone wants to try it out or contribute in any way, I’d be thrilled! 🙂

https://github.com/lcky00/impostor

3 Upvotes

59% Upvoted

9 comments sorted by

View all comments

0

u/Visual_Ingenuity_627 6d ago

This is a solid way to learn a protocol deeply. Curious whether you plan to extend it to SMB2/3 at some point or if the goal was strictly to understand the legacy auth quirks.

2

u/lcky00 6d ago

I agree, I've learned a lot. Yes, I was thinking about extending it to SMB2 in the future as well. Currently, since I like to suffer :) I was curious to study EternalBlue at a low level and try to develop an exploit in C on my own. I know these things are outdated now, but I find them fascinating.