SMB to LDAP relay module #19832
Open
SMB to LDAP relay module #19832
+598
−7
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cdelafuente-r7
changed the title
cdelafuente-r7
commented
Jan 24, 2025
| @@ -99,7 +99,7 @@ def do_session_setup_smb2(request, session) | |||
| response.smb2_header.nt_status = relay_result.nt_status.value | |||
| if relay_result.nt_status == ::WindowsError::NTStatus::STATUS_MORE_PROCESSING_REQUIRED | |||
| response.smb2_header.nt_status = ::WindowsError::NTStatus::STATUS_MORE_PROCESSING_REQUIRED.value | |||
| response.buffer = relay_result.message.serialize | |||
| response.buffer = relay_result.message.serialize if relay_result.message | |||
There was a problem hiding this comment.
I'm not sure why the NTLM type 2 message is not wrapped with GSS-API. I tried to do it but it fails, the client simply reset the connection. If anyone has any idea why?
response.buffer = ::RubySMB::Gss.gss_type2(relay_result.message.serialize) if relay_result.message
cdelafuente-r7
force-pushed
the
mod/relay/smb_to_ldap
branch
from
c093255 to
f839d58
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This module supports running an SMB server which validates credentials, and then attempts to execute a relay attack against an LDAP server on the configured
RELAY_TARGETShosts.It is not possible to relay NTLMv2 to LDAP due to the Message Integrity Check (MIC). As a result, this will only work with NTLMv1. The module takes care of removing the relevant flags to bypass signing.
If the relay succeeds, an LDAP session to the target will be created. This can be used by any modules that support LDAP sessions, like
admin/ldap/rbcdorauxiliary/gather/ldap_query.Supports SMBv2, SMBv3, and captures NTLMv1 as well as NTLMv2 hashes. SMBv1 is not supported - please see #16261
Verification Steps
Lab setup
You will need a Domain Controller and a Domain-joined host:
Domain Computer <-> Metasploit framework <-> Domain Controller
Where:
flowchart LR A("VICTIM (Domain Computer) - 192.168.232.111") subgraph metasploit[" msfconsole - 192.168.232.3 "] subgraph inside [ ] direction TB style inside margin-top: 0 style inside stroke: none B("smb_to_ldap") database[(Database)] B -->|"report_ntlm_type3(...)"| database end end C("DC01 (Domain Controller) - 192.168.232.110") A <-->|SMB 445| metasploit metasploit <-->|"ldap session (TCP/389)"| CThe Domain Computer will need to be configured to use NTLMv1 by setting the following registry key to a value less or equal to 2:
Finally run the relay server on msfconsole, setting the
RELAY_TARGETSoption to the Domain Controller IP address.You will have to coerce the Domain Computer and force it to authenticate to the msfconsole server (see an example below).
Scenarios
Start the relay server
Net use example
A simple test would be using the Windows
net usecommand:msfconsole output:
PetitPotam example
Coerce authentication using a non-privileged Domain User account with PetitPotam:
Exploit Resource-based Constrained Delegation (RBCD)
For details about RCBD, see https://docs.metasploit.com/docs/pentesting/active-directory/kerberos/rbcd.html#rbcd-exploitation
admin/dcerpc/samr_accountmodule and the same Domain User accountadmin/ldap/rbcdmodule using the LDAP sessionadmin/kerberos/get_ticketmodulewindows/smb/psexecmodule