anchor.diff:  = Effective NTLM / SMB Relaying
   :hp-tags: zackattack, smbrelay, youtube, responder
   
  -http://en.wikipedia.org/wiki/SMBRelay[SMB Relay] has been around for a long while. I even have a post about using it along with LNK files here: [MS08-068 + MS10-046 = Fun until 2018](/blog/2012/02/11/ms08_068-ms10_046-fun-until-2018/)
  +http://en.wikipedia.org/wiki/SMBRelay[SMB Relay] has been around for a long while. I even have a post about using it along with LNK files here: link:/blog/2012/02/11/ms08_068-ms10_046-fun-until-2018/[MS08-068 + MS10-046 = Fun until 2018]
   
   Here is the problem though. Most of the tools to exploit it either catch the authentication in NTLMv2/NTLMv1 (which is not always easy to crack) or assume administrative access (because they attempt to PSEXEC with the incoming session). Well, since MS08-068 thats much harder to pin down. You have to know who is going to hit your relay server and what other location they might be an admin on. You also have to a service you want to run on that target.
   
  
positive.code: 
  Now, some would argue that you just spin up the relay at a target then leave it until one pops. I'm not really a fan of that. You will not only be creating multiple access attempt log entries, but you are also just throwing away all of those user authentication attempts. There are 3 tools that agree with me.
  
    1. [Squirtle](https://code.google.com/p/squirtle/)
      * Squirtle is awesome plus it's written in a language I understand (ruby) but it has one serious downfall, many of the post-auth features are left up to the user to develop. It does have a great API but needs some coding to get to do certain things.
    2. [Intercepter-NG](http://intercepter.nerf.ru/)
      * I have tested Interceptre-NG out a lot and it has some fantastic features, not to mention that it does relaying on a Windows host, which is impressive all by itself (due to 445 default bind). My only problem with it is that it's closed source. But definitely recommended.
  
  The 3rd is a tool called "ZackAttack" by [Zack Fasel](https://twitter.com/zfasel), you can find it here on [Github:ZackAttack](https://github.com/urbanesec/ZackAttack). You can find the video of the talk releasing this tool on [Youtube](https://www.youtube.com/watch?v=nHU3ujyw_sQ). So what is so special about this tool? Other than the fact that most of the web interface is broken horribly it has this amazing bit of code that acts as a SOCKS proxy. This SOCKS proxy identifies SMB or HTTP traffic that has NTLM authentication going on and rewrites it based on captured sessions.
  
  What does this mean? If I use SpiderLab's Responder, for instance, to spoof/get/fake a bunch of users into connecting to my machine via automatic or forced methods to the capture/keep services that ZackAttack spins up, I can then run smbclient or Outlook or Web browser, push it through the ZackAttack SOCKS proxy, pick a username out of the captured names, and use any password I want when asked, and the SOCKS proxy will automatically replace it en route with the valid session information.
  
  
negative.code: 
    * http://www.xfocus.net/articles/200305/smbrelay.html[SMBRelay]
    * http://www.tarasco.org/security/smbrelay/[SMBRelay3]
  * https://github.com/SpiderLabs/Responder[SpiderLabs Responder]
    * http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket[SMBRelayX in Impacket]
    * https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/http_ntlmrelay.rb[HTTP NTLM Relay Metasploit Module]
    * https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_relay.rb[SMB Relay PSExec Metasploit Module]
  