SMB Relay

This page deals with gaining code execution relaying NTLMv1/2 hashes in a very effective manner.

Introduction

When capturing a NTLMv1/2 hashes with tools like Responder, attackers have two options:

  • crack it to retrieve cleartext passwords

  • relay it to gain code execution on a target

The relayed user must have privilege on the target.

Valid targets

In order to relay hashes, we must have valid targets. Valid targets are machines with SMB Signing disabled.

SMB Signing is disabled by default on every Windows OS, except Windows Server.

To create a list file of valid targets, use CrackMapExec:

cme smb <networkIP>/<cidr> --gen-relay-list relayTargets.txt

Capture hashes

To capture NTLMv2 hashes, simply use Responder. Before running it, edit the Responder.conf:

[Responder Core]

; Servers to start
SQL = On
SMB = Off     # Turn this off
Kerberos = On
FTP = On
POP = On
SMTP = On
IMAP = On
HTTP = Off    # Turn this off
HTTPS = On
DNS = On
LDAP = On

Then fire up Responder:

Relaying hashes

Instead of cracking Responder hashes, we can relay it to our valid targets to gain code execution on it. For that purpose, you can use Responder's MultiRelay or Impacket's ntlmrelayx.

With ntlmrelayx, you can use and reuse sessions instead of executing a one-shot attack.

One-Shot Attack vs Socks Support.

To use SOCKS support, simply use -sock switch:

Since MS08-068, it is impossible to relay a hash back to the machine it comes from (reflective attack).

Abusing IPv6

Until now, we have abused LLMNR protocol to capture NTLMv2 hashes. It works great, but we can increase the effectiveness of hash relaying by abusing IPv6 protocol too.

The idea is to reply to DHCPv6 requests made by machines on the network to set the attacker IP as the default IPv6 DNS server in order to force victims to authenticate against our attacker machine because of the IPv6 priority over IPv4 in Windows.

Abusing IPv6 protocol with mitm6.

To use mitm6:

To minimize the impact on the network, the lease will expire within 5 minutes when mitm6 is stopped, which will remove the DNS server from the victims configuration.

What to do with sessions?

Many sessions will be established by chaining these exploits:

To interact with these sessions, you need to edit /etc/proxychains.conf:

Retrieving local hashes

Then you can retrieve targets local hashes with Impacket's secretsdump:

You can type anything when you are prompted for a password.

Getting code execution

You also can obtain a shell with Impacket's smbexec and atexec:

psexec or wmiexec do not work here (see references).

Using SMBClient

You can use SMBClient:

Many other protocols can be relayed: imap, ldap, mssql, etc (see references).

References

PreviousExploit Without AccountNextExploit With Account

Last updated