{"action":"created","issue":{"url":"https://api.github.com/repos/CoreSecurity/impacket/issues/82","repository_url":"https://api.github.com/repos/CoreSecurity/impacket","labels_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/82/labels{/name}","comments_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/82/comments","events_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/82/events","html_url":"https://github.com/CoreSecurity/impacket/issues/82","id":101785382,"number":82,"title":"Feature Request - SMBRelay Proxy ","user":{"login":"mubix","id":679319,"avatar_url":"https://avatars.githubusercontent.com/u/679319?v=3","gravatar_id":"","url":"https://api.github.com/users/mubix","html_url":"https://github.com/mubix","followers_url":"https://api.github.com/users/mubix/followers","following_url":"https://api.github.com/users/mubix/following{/other_user}","gists_url":"https://api.github.com/users/mubix/gists{/gist_id}","starred_url":"https://api.github.com/users/mubix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mubix/subscriptions","organizations_url":"https://api.github.com/users/mubix/orgs","repos_url":"https://api.github.com/users/mubix/repos","events_url":"https://api.github.com/users/mubix/events{/privacy}","received_events_url":"https://api.github.com/users/mubix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/CoreSecurity/impacket/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/CoreSecurity/impacket/labels/help%20wanted","name":"help wanted","color":"159818"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-08-19T01:26:53Z","updated_at":"2016-05-24T13:16:21Z","closed_at":null,"body":"There is a more in-detail post here: https://room362.com/post/2014/2014-05-21-effective-ntlm-slash-smb-relaying/\r\n\r\nBut one of the features that I've never seen anywhere else is in a tool called ZackAttack, which is a SMB Relay. Here is how it works:\r\n\r\n1. SMB or HTTP (NTLM) requests come in to a listener. This listener operates a few tricks to make the connections last longer and have multiple requests.\r\n2. During this time a SOCKS proxy is set up and any request that comes through with the username of a known (currently being \"relayed\" / delayed, request, will have it's password rewritten) and relayed to whatever host the attacker wants. There are a few tricks in the relay that allows for even multiple use of one relayed source/victim's set of credentials. (I don't think it sends back an access denied, it does a try again or something (maybe a connection dropped?).\r\n\r\nWhat this does for an attacker that isn't found in any other SMBRelay tool, is allows that attacker the versatility to target different hosts on the fly and based on username: So, if the attacker sees a relay connection coming in from a finance officer, the attacker can target a finance share (not psexec), and if they see a domain admin, can target the domain controller or something, but it's re-invigorates the SMB relay attack in a way that gives the attacker operational decision making. (vs the traditional target one host and give a lot of user's access denied answers - which is loud).\r\n\r\nThe final thing the tool does is store in a JTR format all of the challenge and requests that come in for cracking later.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/CoreSecurity/impacket/issues/comments/221264849","html_url":"https://github.com/CoreSecurity/impacket/issues/82#issuecomment-221264849","issue_url":"https://api.github.com/repos/CoreSecurity/impacket/issues/82","id":221264849,"user":{"login":"mubix","id":679319,"avatar_url":"https://avatars.githubusercontent.com/u/679319?v=3","gravatar_id":"","url":"https://api.github.com/users/mubix","html_url":"https://github.com/mubix","followers_url":"https://api.github.com/users/mubix/followers","following_url":"https://api.github.com/users/mubix/following{/other_user}","gists_url":"https://api.github.com/users/mubix/gists{/gist_id}","starred_url":"https://api.github.com/users/mubix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mubix/subscriptions","organizations_url":"https://api.github.com/users/mubix/orgs","repos_url":"https://api.github.com/users/mubix/repos","events_url":"https://api.github.com/users/mubix/events{/privacy}","received_events_url":"https://api.github.com/users/mubix/received_events","type":"User","site_admin":false},"created_at":"2016-05-24T13:16:21Z","updated_at":"2016-05-24T13:16:21Z","body":"bump ;-)"}}
{"actor":{"display_login":"mubix"}}