[DumpNTLMInfo.py] fix error with 2003

[XiaoliChan]

Fix dump ntlm info when the target is 2003

After

[gabrielg5]

Hi @XiaoliChan,

I've checking this PR. I was able to trigger the exception only if the Server has signing disabled

Tried with these setting set as Enabled and the example worked fine

┌──(XXXXX㉿YYYYY)-[~/Desktop/impacket/examples]
└─$ python DumpNTLMInfo.py xxx.XXX.xxx.XXX -debug
Impacket v0.12.0.dev1+20231015.203043.419e6f24 - Copyright 2023 Fortra

[+] Impacket Library Installation Path: /home/XXXXX/.local/lib/python3.11/site-packages/impacket
[+] SMBv1 Enabled : True
[+] Prefered Dialect: NT LM 0.12
[+] Server Security : SIGNING_ENABLED | SIGNING_REQUIRED
[+] Max Read Size : 16.25 KB (16644 bytes)
[+] Max Write Size : 16.25 KB (16644 bytes)
[+] Current Time : 2023-10-26 00:24:27.589375+00:00
[+] Name : XXXXXXX
[+] Domain : XXXXXXX
[+] DNS Domain Name : xxxxxxx
[+] DNS Host Name : xxxxxxx
[+] OS : Windows NT 5.2 Build 3790
[+] Null Session : True

Analyzing it a bit more in depth, found that the SecurityMode property is being set in this function (for the SMB1 protocol)

impacket/examples/DumpNTLMInfo.py

Lines 255 to 265 in f73bd0f

	def _wrapper(self, sessionResponse):
	sessionResponse['DialectRevision'] = SMB_DIALECT
	if self._dialects_parameters['SecurityMode'] & SMB.SECURITY_SIGNATURES_ENABLED:
	sessionResponse['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_ENABLED
	if self._SignatureRequired:
	sessionResponse['SecurityMode'] |= SMB2_NEGOTIATE_SIGNING_REQUIRED
	sessionResponse['MaxReadSize'] = self._dialects_parameters['MaxBufferSize']
	sessionResponse['MaxWriteSize'] = self._dialects_parameters['MaxBufferSize']
	sessionResponse['SystemTime'] = self._to_long_filetime(self._dialects_parameters['LowDateTime'], self._dialects_parameters['HighDateTime'])
	sessionResponse['ServerStartTime'] = 0 # SMB1 has not boot time totally
	return sessionResponse

So, there's a flow in the function that could end up with SecurityMode not set.
I guess it would be better to handle this scenario directly in this function.

Perhaps by adding

sessionResponse['SecurityMode'] = 0x0

at the beginning?
So everything is contextualized in that funciton... what do you think?

[XiaoliChan]

Perhaps by adding

sessionResponse['SecurityMode'] = 0x0

at the beginning? So everything is contextualized in that funciton... what do you think?

That sounds a good idea! ^^

[gabrielg5]

Just readded those spaces at the end-of-lines to make the PR changes cleaner ;)

[gabrielg5]

Hey, awesome!

you can update the PR with that and I'll merge it right away

thanks!!

[XiaoliChan]

@gabrielg5 Everything is done!

[gabrielg5]

Thanks @XiaoliChan 🚀