anchor.diff:  
     * http://www.xfocus.net/articles/200305/smbrelay.html[SMBRelay]
     * http://www.tarasco.org/security/smbrelay/[SMBRelay3]
  -  * https://github.com/SpiderLabs/Responder[SpiderLabs Responder]
  +* https://github.com/SpiderLabs/Responder[SpiderLabs Responder]
     * http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket[SMBRelayX in Impacket]
     * https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/http_ntlmrelay.rb[HTTP NTLM Relay Metasploit Module]
     * https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_relay.rb[SMB Relay PSExec Metasploit Module]
  
positive.code: 
  **Update: One thing to mention that ZackAttack does that I haven't seen other tools do, even Squirtle or Intercepter-NG is getting 3+ successful authentications out of a single relay from a user. ZackAttack does this with some clever HTTP Keep-Alive and SMB "reauth" kung fu.**
  
  <iframe width="420" height="315" src="//www.youtube.com/embed/05W5tUG7z2M" frameborder="0" allowfullscreen></iframe>
  
  
  ### Other References:
  
    * [2014-02 **SpiderLabs** - Responder 2.0 Owning Windows Networks Part 3](http://blog.spiderlabs.com/2014/02/responder-20-owning-windows-networks-part-3.html)
    * [2014-01 **NetSPI Blog** - SMB Attacks Through Directory Traversal](https://www.netspi.com/blog/entryid/213/smb-attacks-through-directory-traversal)
    * [2013-06 **Ares** - SMB Hijacking Kerberos is defeated](http://intercepter.nerf.ru/SMB_Hijacking.Kerberos_is_defeated.pdf)
    * [2013-04 **SANS Pentesting Blog** - SMB Relay Demystified and NTLMv2 Pwnage with Python](http://pen-testing.sans.org/blog/pen-testing/2013/04/25/smb-relay-demystified-and-ntlmv2-pwnage-with-python)
    * [2013-01 **Core Security Training Video** - How To Perform a SMB Relay Attack](http://www.screencast.com/users/Core_Security/folders/Training%20Videos%20for%20CORE%20Impact%20Pro/media/c48247ab-1f0b-4e86-a78a-1d7e347c0989)
    * [2013-01 **Mark Gamache** - NTLM Challenge Response is 100% Broken](http://markgamache.blogspot.com/2013/01/ntlm-challenge-response-is-100-broken.html)
    * [2012-12 **NetSPI Blog** - Executing SMB Relay Attacks via SQL Server using Metasploit](https://www.netspi.com/blog/entryid/139/executing-smb-relay-attacks-via-sql-server-using-metasploit)
    * [2012-07 **WebstersProdigy** - Metasploit Generic NTLM Relay Module](http://webstersprodigy.net/2012/07/22/metasploit-generic-ntlm-relay-module/)
    * [2012-04 **Ares** - Actuality of SMBRelay in Modern Windows Networks](http://intercepter.nerf.ru/Actuality_of_SMBRelay_in_Modern_Windows_Networks.pdf)
    * [2011-01 **Digital Security Research Group Blog** - SMBRelay Bible](http://erpscan.com/?s=smbrelay+bible&x=0&y=0)
    * [2009-07 **Carnal0wnage** - Metasploit Oracle TNSCMD SMBRelay Demo](http://vimeo.com/5500931)
    * [2008-11 **Ron Bowes** - Preventing SMB Relay Attacks](https://blog.skullsecurity.org/2008/ms08-068-preventing-smbrelay-attacks)
    * [2008-08 **Kurt Grutzmacher at DEF CON 16** - NTLM is Dead!](http://squirtle.googlecode.com/files/NTLM%20is%20Dead%20-%20DefCon%2016.pdf)
    * [2008-06 **John Heasman** - Stealing Password Hashes with Java and IE](http://heasman.blogspot.com/2008/06/stealing-password-hashes-with-java-and.html)
    * [2008-04 **Eric Rachner: NTLM Relay Attacks** - Released tool 'scurvy'](http://www.powershow.com/view/28526-OWZjN/NTLM_Relay_Attacks_powerpoint_ppt_presentation)
    * [2007-08 **HD Moore and Valsmith** - Tactical Exploitation](https://www.blackhat.com/presentations/bh-usa-07/Moore_and_Valsmith/Presentation/bh-usa-07-moore_and_valsmith.pdf)
    * [2004-12 (ARCHIVE.ORG) **Jesse Burns at SySCAN** - NTLM Authentication Unsafe](https://web.archive.org/web/20060719183135/http://www.isecpartners.com/documents/NTLM_Unsafe.pdf)
    * [2002-01 **Azbil SecurityFriday Ltd** - ScoopLM](http://www.securityfriday.com/tools/ScoopLM.html)
    * [2001-03 **@lantaCon** - Reference from **March 31 2001 talk**](http://www.xfocus.net/articles/200305/smbrelay.html)
    
  I tried finding all the original/semi original references about SMB (LM/NTLM) Relaying. If you have others please leave a comment below so I can add them to the list.
    
negative.code: = Effective NTLM / SMB Relaying
  :hp-tags: zackattack, smbrelay, youtube, responder
  
  http://en.wikipedia.org/wiki/SMBRelay[SMB Relay] has been around for a long while. I even have a post about using it along with LNK files here: link:/blog/2012/02/11/ms08_068-ms10_046-fun-until-2018/[MS08-068 + MS10-046 = Fun until 2018]
  
  Here is the problem though. Most of the tools to exploit it either catch the authentication in NTLMv2/NTLMv1 (which is not always easy to crack) or assume administrative access (because they attempt to PSEXEC with the incoming session). Well, since MS08-068 thats much harder to pin down. You have to know who is going to hit your relay server and what other location they might be an admin on. You also have to a service you want to run on that target.
  
  