SMBRelay
Brief
Instead of cracking hashes to find the clear password, you can relay those hashes to specific machines and potentially gain access.
Now, this attack requires two things :
SMB signing must be disabled on the target (NOTE: by default, SMB Signing is enabled on all DC servers)
Relayed user credentials must be admin on the machine (we can't relay the hash to the same machine since MS08-068, and the user we're relaying must have admin rights on the target machine if we want code execution otherwise user access if there's an open-share for example)
Attack
In order to relay hashes, we must have valid targets. Valid targets are, as predescribed, machines with SMB Signing disabled. So to get a list of those valide targets we can use for example CrackMapExec :
Now off to capture the hashes, but we first need to change a little configuration in the responder.conf file (/usr/share/responder/responder.conf) :
Interact with ntmlrelayx sessions
Proxychains
Retrieve hashes
Last updated
Was this helpful?