Forcing impacket and Metasploit to use SMB2

When I’m building detection rules for specific SMB traffic patterns, I need the tools generating test traffic to cooperate. impacket defaults to SMB3. Metasploit follows suit. Here’s how to push both down to SMB2.

impacket

The dialect preference lives in impacket/smbconnection.py around line 79. Change the preferredDialect parameter:

self._SMBConnection = smb3.SMB3(self._remoteName, self._remoteHost, self._myName, hostType,
                                self._sess_port, self._timeout, preferredDialect=SMB2_DIALECT_21)

Available constants:

• SMB2_DIALECT_002 — SMB 2.0.2
• SMB2_DIALECT_21 — SMB 2.1 (what I use)

Metasploit

Disable SMB encryption to force a protocol downgrade:

msf6 exploit(windows/smb/psexec) > set SMB::AlwaysEncrypt false
SMB::AlwaysEncrypt => false

Verify

Capture with Wireshark or tcpdump and confirm the SMB2 negotiation packets. The dialect value in the Negotiate Protocol Request should match what you set.