All right.
So now let's talk about SMB relay.
Well what is SMB relay.
So think about your responder and think about how you were capturing these hashes.
Well instead of taking the hashes out you capture off line and trying to crack them with hash cat.
Well we can take those hashes and we can actually just relay those to another machine.
Well how is this possible.
So let's talk about the requirements.
Big requirement number one requirement is that SMB signing has to be disable on the target.
Now SMB signing is a packet level protocol so let's think about this.
If SMB signing is enabled when we tried to relay credentials it's going to say hey you're not really
that person.
I you know this package is not signed by you and I'm not gonna let you in.
But if S&P signing is disabled it never checks for that.
It never checks for authenticity of where this is coming from.
It just says hey there's a user there's their hash.
I'm going to let them on this machine if they have the permission to do so.
So we're going to take this first requirement and add in a second requirement which is that the user
being relayed has to have admin credentials on that machine.
So we cannot relay a credential that we captured from one machine back to the same machine say we're
like dot six we can't really that credential to about six as well.
This has to be on two separate machines.
And that user has to be an addon on that machine with SMB signing disabled.
So we're going to take say Frank Castle.
He's going to be an admin on two machines like we set.
We're gonna take the captured hash relay it over to another machine where he's also in Amman and we're
gonna do some malicious things to that machine.
So let's take a look at this from a more actual perspective.
So the first thing we're going to do is we're actually going to go into the responder configuration
file and we're gonna turn off S&P and HP.
So we're going to be listening but we're not going to be responding on these servers.
OK so what that means is we're going to use responder to capture and then we're gonna use another tool
to relay but we're not actually going to respond back.
So once this configuration is set what we're gonna do is we're going to boot up responder so with responder
booted up the same way as before you're going to notice here the only difference is there's red on the
HDP and red on the SMB server the off proxy was off by default and still remains off.
So this is how your configuration should look.
Once this is configured we also need to configure a tool called MTM relay X so a.m. relay X takes the
relay it passes it to a target file that you specify and we'll talk about how we identify those targets
in the next video and then we're going to say SMB to support as a switch as well so that we can incorporate
anything with SMB too.
So what we're gonna do here is all we're doing is identifying where we want to target and where we want
to relay to.
So we have our responder listening.
We have our relay ready to go.
And then we just wait for an event to happen.
Same event as before we point at this machine with responder listening it can't access this machine
DNS fails.
Okay responder kicks in response to that message or doesn't respond to that message I should say and
instead it relays these credentials that it captures to this other machine you could see it here it
says hey we received a connection from 10 to zero to three that seven and we're going to attack the
target of ten down there out three that six using Frank Castle's credentials if Frank Castle is in Adam
on that machine this is gonna work.
So authenticates against it.
It succeeds.
Guess what.
Now we're coming in here and we're dumping out sensitive information.
Most importantly we are dumping out what is called a Sam file or the Sam hashes here right now.
Remember back to our lesson on Linux when we talked about shadow files.
Think of the Sam as the shadow of the Windows world.
These are all of our usernames and hashes for the local users on this computer.
Again this is the local users on this computer.
This is not the domain users but that's OK.
We can take down an entire network and I've done it before utilizing only local users.
We're going to talk about that in a later video on how that can happen.
But from here we have usernames and hashes.
OK.
We could take these hashes offline again and try to crack them or we can pass this hash around and try
to get access to other machines as well.
So take a look at both of those and see why this is really really interesting here later on.
So for now take away that we grab a hash we relayed to another machine if S&P signing is disabled we
can get on that machine is in Amman we can not only dump the Sam hashes like this but we can also take
it further and get a full shell.
If we want to.
So we're going to do that in both scenarios we're gonna play this scenario first.
Then we're gonna play another scenario out where we actually get a shell.
You can see how you can do both of those.
So let's go ahead and move on to the next video.
We're actually going to demonstrate in SMB really.