SMB relay
Instead of cracking hashes to find the clear password, you can relay those hashes to specific machines and potentially gain access.
For refreshing our memory about the different types of NTLMs and Relaying 101 and pass-the-hash attack i suggest you read these 2 awesome posts :
Now, this attack requires two things :
SMB signing must be disabled on the target
Relayed user credentials must be admin on the machine (we can't relay the hash to the same machine since MS08-068, and the user we're relaying must have admin rights on the target machine if we want code execution otherwise user access if there's an open-share for example)
In order to relay hashes, we must have valid targets. Valid targets are, as predescribed, machines with SMB Signing disabled. So to get a list of those valide targets we can use for example CrackMapExec
or Nmap :
NOTE: By default, SMB signing is enabled on all DC servers Now off to capture the hashes, but we first need to change a little configuration in the responder.conf file (/usr/share/responder/responder.conf)
Then again fire up responder :
Now off to the relay, pop up a new shell and use ntlmrelayx.py to relay the intercepted hashes :
You should be seeing something cool appearing on your ntlmrelay window.
Now while that's cool, what can we do with the opened sessions ? if you tap socks you should see something like that :
To interact with these sessions we'll use the tool proxychains, but first you need to edit the conf file found in /etc/proxychains.conf:
Now that's done, you can for example retrieve local hashes using secretsdump
Or even get code execution via :
You can even specify the commands you want to execute before launching ntlmrelayx :
or even set a meterpreter listeneter and get shell access via metasploit :
Last updated