anchor.diff:  
   Now, some would argue that you just spin up the relay at a target then leave it until one pops. I'm not really a fan of that. You will not only be creating multiple access attempt log entries, but you are also just throwing away all of those user authentication attempts. There are 3 tools that agree with me.
   
  -  1. [Squirtle](https://code.google.com/p/squirtle/)
  +  1. https://code.google.com/p/squirtle/[Squirtle]
       * Squirtle is awesome plus it's written in a language I understand (ruby) but it has one serious downfall, many of the post-auth features are left up to the user to develop. It does have a great API but needs some coding to get to do certain things.
  -  2. [Intercepter-NG](http://intercepter.nerf.ru/)
  +  2. http://intercepter.nerf.ru/[Intercepter-NG]
       * I have tested Interceptre-NG out a lot and it has some fantastic features, not to mention that it does relaying on a Windows host, which is impressive all by itself (due to 445 default bind). My only problem with it is that it's closed source. But definitely recommended.
   
  -The 3rd is a tool called "ZackAttack" by [Zack Fasel](https://twitter.com/zfasel), you can find it here on [Github:ZackAttack](https://github.com/urbanesec/ZackAttack). You can find the video of the talk releasing this tool on [Youtube](https://www.youtube.com/watch?v=nHU3ujyw_sQ). So what is so special about this tool? Other than the fact that most of the web interface is broken horribly it has this amazing bit of code that acts as a SOCKS proxy. This SOCKS proxy identifies SMB or HTTP traffic that has NTLM authentication going on and rewrites it based on captured sessions.
  +The 3rd is a tool called "ZackAttack" by https://twitter.com/zfasel[Zack Fasel], you can find it here on https://github.com/urbanesec/ZackAttack[Github:ZackAttack]. You can find the video of the talk releasing this tool on https://www.youtube.com/watch?v=nHU3ujyw_sQ[Youtube]. So what is so special about this tool? Other than the fact that most of the web interface is broken horribly it has this amazing bit of code that acts as a SOCKS proxy. This SOCKS proxy identifies SMB or HTTP traffic that has NTLM authentication going on and rewrites it based on captured sessions.
   
   What does this mean? If I use SpiderLab's Responder, for instance, to spoof/get/fake a bunch of users into connecting to my machine via automatic or forced methods to the capture/keep services that ZackAttack spins up, I can then run smbclient or Outlook or Web browser, push it through the ZackAttack SOCKS proxy, pick a username out of the captured names, and use any password I want when asked, and the SOCKS proxy will automatically replace it en route with the valid session information.
   
  
positive.code: 
  **Update: One thing to mention that ZackAttack does that I haven't seen other tools do, even Squirtle or Intercepter-NG is getting 3+ successful authentications out of a single relay from a user. ZackAttack does this with some clever HTTP Keep-Alive and SMB "reauth" kung fu.**
  
  <iframe width="420" height="315" src="//www.youtube.com/embed/05W5tUG7z2M" frameborder="0" allowfullscreen></iframe>
  
  
  ### Other References:
  
    * [2014-02 **SpiderLabs** - Responder 2.0 Owning Windows Networks Part 3](http://blog.spiderlabs.com/2014/02/responder-20-owning-windows-networks-part-3.html)
    * [2014-01 **NetSPI Blog** - SMB Attacks Through Directory Traversal](https://www.netspi.com/blog/entryid/213/smb-attacks-through-directory-traversal)
    * [2013-06 **Ares** - SMB Hijacking Kerberos is defeated](http://intercepter.nerf.ru/SMB_Hijacking.Kerberos_is_defeated.pdf)
    * [2013-04 **SANS Pentesting Blog** - SMB Relay Demystified and NTLMv2 Pwnage with Python](http://pen-testing.sans.org/blog/pen-testing/2013/04/25/smb-relay-demystified-and-ntlmv2-pwnage-with-python)
    * [2013-01 **Core Security Training Video** - How To Perform a SMB Relay Attack](http://www.screencast.com/users/Core_Security/folders/Training%20Videos%20for%20CORE%20Impact%20Pro/media/c48247ab-1f0b-4e86-a78a-1d7e347c0989)
    * [2013-01 **Mark Gamache** - NTLM Challenge Response is 100% Broken](http://markgamache.blogspot.com/2013/01/ntlm-challenge-response-is-100-broken.html)
    * [2012-12 **NetSPI Blog** - Executing SMB Relay Attacks via SQL Server using Metasploit](https://www.netspi.com/blog/entryid/139/executing-smb-relay-attacks-via-sql-server-using-metasploit)
    * [2012-07 **WebstersProdigy** - Metasploit Generic NTLM Relay Module](http://webstersprodigy.net/2012/07/22/metasploit-generic-ntlm-relay-module/)
    * [2012-04 **Ares** - Actuality of SMBRelay in Modern Windows Networks](http://intercepter.nerf.ru/Actuality_of_SMBRelay_in_Modern_Windows_Networks.pdf)
    * [2011-01 **Digital Security Research Group Blog** - SMBRelay Bible](http://erpscan.com/?s=smbrelay+bible&x=0&y=0)
    * [2009-07 **Carnal0wnage** - Metasploit Oracle TNSCMD SMBRelay Demo](http://vimeo.com/5500931)
    * [2008-11 **Ron Bowes** - Preventing SMB Relay Attacks](https://blog.skullsecurity.org/2008/ms08-068-preventing-smbrelay-attacks)
    * [2008-08 **Kurt Grutzmacher at DEF CON 16** - NTLM is Dead!](http://squirtle.googlecode.com/files/NTLM%20is%20Dead%20-%20DefCon%2016.pdf)
    * [2008-06 **John Heasman** - Stealing Password Hashes with Java and IE](http://heasman.blogspot.com/2008/06/stealing-password-hashes-with-java-and.html)
    * [2008-04 **Eric Rachner: NTLM Relay Attacks** - Released tool 'scurvy'](http://www.powershow.com/view/28526-OWZjN/NTLM_Relay_Attacks_powerpoint_ppt_presentation)
    * [2007-08 **HD Moore and Valsmith** - Tactical Exploitation](https://www.blackhat.com/presentations/bh-usa-07/Moore_and_Valsmith/Presentation/bh-usa-07-moore_and_valsmith.pdf)
    * [2004-12 (ARCHIVE.ORG) **Jesse Burns at SySCAN** - NTLM Authentication Unsafe](https://web.archive.org/web/20060719183135/http://www.isecpartners.com/documents/NTLM_Unsafe.pdf)
    * [2002-01 **Azbil SecurityFriday Ltd** - ScoopLM](http://www.securityfriday.com/tools/ScoopLM.html)
    * [2001-03 **@lantaCon** - Reference from **March 31 2001 talk**](http://www.xfocus.net/articles/200305/smbrelay.html)
    
  I tried finding all the original/semi original references about SMB (LM/NTLM) Relaying. If you have others please leave a comment below so I can add them to the list.
    
negative.code: 
    * http://www.xfocus.net/articles/200305/smbrelay.html[SMBRelay]
    * http://www.tarasco.org/security/smbrelay/[SMBRelay3]
  * https://github.com/SpiderLabs/Responder[SpiderLabs Responder]
    * http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket[SMBRelayX in Impacket]
    * https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/http_ntlmrelay.rb[HTTP NTLM Relay Metasploit Module]
    * https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_relay.rb[SMB Relay PSExec Metasploit Module]
  