SMB: endpoint fingerprinting
Tags: security, network, dfir, smb
Published: 2020-03-02 08:46:38

**Welcome to another article on network forensics. We are still talking about the SMB protocol family, but this time let's focus on messages that carry hints about the connected endpoints. These hints can be used to infer knowledge about the client and server (e.g. OS version). This process is called fingerprinting.**

## Protocol negotiation

SMB1 [NegotiateProtocolRequest](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/25c8c3c9-58fc-4bb8-aa8f-0272dede84c5) (`smb.cmd == 0x72`) carries information about the dialects that the client understands. Similarly SMB2 [NEGOTIATE request](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/e14db7ff-763a-4263-8b10-0c3944f52fc5) (`smb2.cmd == 0`) contains a list of client's dialects and SMB 3.x capabilities. These bits are specific to client implementation (or configuration) and thus can be used as part of the client's fingerprint.

The same applies for the response as well. Fields like server capabilities
(`smb.server_cap`), system time (`smb.system.time`), time zone (`smb.server_timezone`), boot time (`smb2.boot_time`) or authentication mechanisms (`spnego.mechTypes`) can tell a lot about the server endpoint.

![smb negotiation response](https://thepracticaldev.s3.amazonaws.com/i/wyalaw0hvsi4o8m4efyh.png)

**Wireshark filter:** `smb.cmd == 0x72 or smb2.cmd == 0`
**PCAP sample:** [smb-on-windows-10.pcapng](https://wiki.wireshark.org/SMB2?action=AttachFile&do=view&target=smb-on-windows-10.pcapng) on Wireshark wiki

## NTLM authentication

NTLM authentication has been long superseded by a more secure Kerberos, but in my experience it can still be found wildly in public institutions and smaller companies and sometimes even in corporate networks. From a forensic POV we are mainly interested in usernames, hostnames and NTLM hashes:     

![username in ntlmssp packet](https://thepracticaldev.s3.amazonaws.com/i/q1evx42pml1vvq29dyi2.png)

**Wireshark filter:** `ntlmssp` (or `gss-api` for all negotiation packets)
**PCAP sample:** [smb-on-windows-10.pcapng](https://wiki.wireshark.org/SMB2?action=AttachFile&do=view&target=smb-on-windows-10.pcapng) on Wireshark wiki

## Kerberos authentication

In case of Kerberos there are still useful metadata like realm aka. domain name (`kerberos.crealm`), principals aka. user/server names (`kerberos.cname`/`kerberos.pname`/`kerberos.sname`), auth period (`kerberos.from`/`kerberos.til`) and more.

![kerberos packet](https://thepracticaldev.s3.amazonaws.com/i/2jtknlot20ixyvr6s3n4.png)

Also, Kerberos AS-REPs (`kerberos.cipher` field) can sometimes be cracked to yield credentials [e.g. with John the Ripper](https://blog.xpnsec.com/kerberos-attacks-part-2/).

**Wireshark filter:** `kerberos` (or gss-api for all negotiation packets)
**PCAP sample:** [Kerberos-CIFS.Cap](https://www.pcapr.net/view/alejandro.ayala/2009/2/2/11/Kerberos-CIFS.Cap.html) at pcapr


## SPOOLSS GetPrinterData

OK this is probably a really niché case, but hey, that's what forensics is all about. When using a shared network printer, MS Spool Subsystem (`spoolss`) is typically used over SMB/RPC stack. Once that printer is available, the OS can request various printer data using [`GetPrinterData`](https://docs.microsoft.com/en-us/windows/win32/printdocs/getprinterdata) function. Inspecting these data can reveal interesting bits, e.g. OS Version of the print server.

![smb spoolss getprinterdata response] (https://thepracticaldev.s3.amazonaws.com/i/rj9lam6odcbkrs3vnik3.png)

**Wirehsark filter:** `spoolss.printerdata`

---

If you're interested in reading more about OS/application/device fingerprinting, there's sadly not many links I could point you to. Tools like [p0f](http://lcamtuf.coredump.cx/p0f3/) or [nmap](https://nmap.org/book/man-os-detection.html) can provide a good start. You can also read [this post by SecurityTrails](https://securitytrails.com/blog/cybersecurity-fingerprinting) which summarizes different means of fingerprinting including SSH or TLS protocols.

## References

- [F-Secure: Endpoint Detection of Remote Service Creation and PsExec](https://blog.f-secure.com/endpoint-detection-of-remote-service-creation-and-psexec/)
- [401TRG: An Introduction to SMB for Network Security Analysts](https://401trg.com/an-introduction-to-smb-for-network-security-analysts/amp/)
- [XPN: Kerberos AD Attacks - More Roasting with AS-REP](https://blog.xpnsec.com/kerberos-attacks-part-2/)