top of page
Search

SMB Relay: An AD Attack

  • Writer: Strider Gearhead
    Strider Gearhead
  • Jul 12, 2023
  • 1 min read

What is SMB Relay?

  • Instead of cracking the hashes gathered with Responder, we can instead relay those hashes to specific machines and potentially gain access.

Requirements:

  • SMB signing must be disabled on the target.

  • Relayed user credentials must be admin on machine.

SMB signing will check that the packets are coming from right place and it is signed.

If the SMB signing is enabled then it will not let the packets to send and it will say that you are not the right person to send the packets.

And if the SMB signing is disabled then it will basically see that there is a user and a hash and it will let the user on the machine.

Steps:

Step 1: Run Responder gedit Responder.conf and will turn off the HTTP and SMB.
ree

If you want to read the full writeup:


 
 
 

Comments

bottom of page