[Samba] Does samba provide a fuzzing mode that uses deterministic NTLMSSP_Challenge?

[Douglas Bagnall]

hi Fouzhe,

On 9/01/23 15:57, fouzhe via samba wrote:
> Recently I want to fuzz samba systematically (instead of functional fuzzing like OSS-Fuzz/samba). However, the fuzzer acts like smbclient and needs to establish a connection with the samba server via NTLM authentication. The NTLMSSP_Challenge sent by the server is not deterministic, which can render the fuzzing based on previously captured traffic futile. Does samba provide a fuzzing mode that uses deterministic NTLMSSP_Challenge, or how can I directly bypass the authentication stage?
> 

That question might get more answers on the samba-technical list.

https://lists.samba.org/mailman/listinfo/samba-technical

In the mean time the best answer I have is I don't think so.

Some of what you want might be possible with LD_PRELOAD or something to 
intercept gnutls_rnd().

cheers,
Douglas