NTLMRecon - A Tool To Enumerate Information From NTLM Authentication Enabled Web Endpoints

[ALBERT]

A fast and flexible NTLM reconnaissance tool without external dependencies. Useful to find out information about NTLM endpoints when working with a large set of potential IP addresses and domains.
NTLMRecon is built with flexibilty in mind. Need to run recon on a single URL, an IP address, an entire CIDR range or combination of all of it all put in a single input file? No problem! NTLMRecon got you covered. Read on.
Internal wordlists are from the awesome nyxgeek/lyncsmash repo
Overview
NTLMRecon looks for NTLM enabled web endpoints, sends a fake authentication request and enumerates the following information from the NTLMSSP response:

1. AD Domain Name
2. Server name
3. DNS Domain Name
4. FQDN
5. Parent DNS Domain

Since ntlmrecon leverages a python implementation of NTLMSSP, it eliminates the overhead of running Nmap NSE http-ntlm-info for every successful discovery.
Installation
Arch
If you're on Arch Linux or any Arch linux based distribution, you can grab the latest build from AUR
Generic Installation

1. Clone the repository - git clone https://github.com/sachinkamath/ntlmrecon/
2. RECOMMENDED - Install virtualenv pip install virtualenv
3. Start a new virtual environment - virtualenv venv and activate it with source venv/bin/activate
4. Run the setup file - python setup.py install
5. Run ntlmrecon - ntlmrecon --help

Download NTLMRecon