Relaying Net-NTLMv2
In this section, we’ll have access to FILES01 as an unprivileged user,
which means we cannot run Mimikatz to extract passwords.
Using the steps from the previous section,
imagine we obtained the Net-NTLMv2 hash,
but couldn’t crack it because it was too complex.
What we can assume based on the username
is that the user may be a local administrator on FILES02.
Therefore, we can try to use the hash on another machine
in what is known as a relay attack.
In this attack, we’ll again use the dir command in the bind shell
to create an SMB connection to our Kali machine.
Instead of merely printing the Net-NTLMv2 hash used in the authentication step,
we’ll forward it to FILES02.
If files02admin is a local user of FILES02,
the authentication is valid and therefore accepted by the machine.
If the relayed authentication is from a user with local administrator privileges,
we can use it to authenticate and then execute commands over SMB
with methods similar to those used by psexec or wmiexec.
We’ll perform this attack with ntlmrelayx, another tool from the impacket library.
This tool does the heavy lifting for us by setting up an SMB server
and relaying the authentication part of an incoming SMB connection
to a target of our choice.
Let’s get right into the attack by starting ntlmrelayx,
which we can use with the pre-installed impacket-ntlmrelayx package.
We’ll use --no-http-server to disable the HTTP server
since we are relaying an SMB connection and -smb2support to add support for SMB2.
We’ll also use -t to set the target to FILES02.
Finally, we’ll set our command with -c,
which will be executed on the target system as the relayed user.
We’ll use a PowerShell reverse shell one-liner
using the IP of our Kali machine and port 8080,
which we’ll base64-encode and execute with the -enc argument
as we’ve done before in this course.
Next, we’ll start a Netcat listener
on port 8080 to catch the incoming reverse shell.
Now we’ll run Netcat in another terminal to connect to the bind shell on FILES01.
After we connect, we’ll create an SMB connection to our Kali machine.
Again, the remote folder name is arbitrary.
We should receive an incoming connection in our ntlmrelayx tab.
The output indicates that ntlmrelayx received an SMB connection
and used it to authenticate to our target by relaying it.
After successfully authenticating, our command was executed on the target.
Our Netcat listener should have caught the reverse shell.
The output shows that we could leverage a relay attack
to get code execution on FILES02.
In this section, we demonstrated
that we can leverage our ability to start an SMB connection
to either crack or relay the Net-NTLMv2 hash.
However, UAC remote restrictions limit the users we can use in pass-the-hash
or relay attacks outside of an Active Directory environment.