SMB Relaying
Last updated
Last updated
After observing LLMNR and/or NBT-NS traffic with Responder and forcing the client to authenticate to your machine, it is possible for the attacker to relay the Net-NTLMv2 hash obtained to all systems within scope that have SMB Signing Disabled.
Finger is included with Responder.py in the /tools directory. Simply run the tool against either a subnet or file and parse the results using cut
A list can also easily be created with :
Nmap can also create a list of hosts that have SMB Signing Disabled:
After confirming LLMNR/NBT-NS traffic and identifying systems with SMB Signing Disabled, we are ready to perform the attack. First, we need modify the Responder.conf file and disable both SMB and HTTP:
We can then run Responder:
We can then run ntlmrelayx.py from Impacket, supplying our file of hosts previously identified to have SMB Signing Disabled.
We can also enable SOCKS support while relaying for interactive sessions. Using this flag will also provide you with a session on the host if the user is not a local administrator:
