NTLMRelaying (445)

Basics

NTLM Relaying is a method of intercepting the NetNTLM hash, sent by a client to authenticate against an SMB server.

For this attack to be successful, a number of prerequisites must exist in a domain. It is essential that a domain resolves server names using Link Local Multicast Name Resolution (LLMR) or the NetBIOS Name Resolution (NBT-TS). In addition SMB Signing must be deactivated. These can the checked during previous enumeration. To check if a domain resolves names via LLMR or NBT-TS you can use responders in analyze mode.

If these prerequisites are met, you can use Responder to poison such a request to send the IP of our malicious SMB server address to the clients. More Information can be found in the attack section of this site.

Attack

ntlmrelay.py

Analyze network traffic to check for LLMR / NBT-TS

sudo Responder -I <INTERFACE> -A