SMBRelay
Last updated
Last updated
Instead of cracking hashes to find the clear password, you can relay those hashes to specific machines and potentially gain access.
Now, this attack requires two things :
SMB signing must be disabled on the target (NOTE: by default, SMB Signing is enabled on all DC servers)
Relayed user credentials must be admin on the machine (we can't relay the hash to the same machine since MS08-068, and the user we're relaying must have admin rights on the target machine if we want code execution otherwise user access if there's an open-share for example)
In order to relay hashes, we must have valid targets. Valid targets are, as predescribed, machines with SMB Signing disabled. So to get a list of those valide targets we can use for example CrackMapExec :
Now off to capture the hashes, but we first need to change a little configuration in the responder.conf file (/usr/share/responder/responder.conf) :
