The NTLM relay attack is not particularly difficult.
It's just because there are a lot of parts to it can be quite confusing.
Now I've got my, system beacon running here on
workstation two.
So I'm gonna use that to set up and carry out the entire attack really.
The first thing that I'm gonna do is create the reverse that
we need.
So the first one is gonna be, eight four four five,
and I'm gonna read to port four four five on the team server.
And then another one for eighty eighty
to redirect to to eighty.
So this one will be to, capture the SMB, traffic.
And this one will be for, the PowerShell download cradle.
The next thing is to create firewall rules for those to
allow the traffic, inbound.
So I'm gonna just paste this command here.
So this is for eight four four five
and then another one for eighty eighty.
Then the last thing will just be to start
a
proxy.
So that will allow NTLM relay x to send the traffic back into the net
Okay. So now we can, start NTLM relay X.
So I've copied this command from the, course material.
And the payload I already have hosted here.
So this is an SMB payload
that you can host through
the scripted web delivery or the host file.
So now that this is running, let's load, port vendor.
So we can go to script manager
and load the port vendor c n a.
We also need to upload its driver.
So let's go to
c Windows system thirty two drivers
and then upload
the WinDivert driver and make make sure it's the sixty four bit version.
Because this is a sixty four bit beacon and
now we have,
the port vendor commands.
So let's do port vendor
and we're going to redirect everything hitting port four
four five to eight four four five.
So
inbound S and B traffic is gonna come in on four four five.
The driver will redirect that traffic to eight four four
five, which is where
one of our reverse port forwards is listening.
That will send the traffic back down to the team server on four
forty five, which is where NTLM relay X,
is
and then this will do the relaying back over the socks proxy.
So that's kind of how the traffic flow
works.
And then, of course, because this is a download cradle,
that will also come over the,
reverse portfolio that we created for on port eighty eighty.
So let's start this.
And if you don't,
see this text here, then probably the driver did not load.
You can check with jobs so you'll want to see a port
vendor job running here.
If, not then you've done something wrong.
So with that, let's go over to workstation one,
and we're going to trigger
this SMB authentication by trying to list a non
existent SMB share.
So let's go back to the attack, desktop,
and you should see all of these logs here.
Now a lot of stuff happens in a short space of time.
So port vendor
spits out these, connection attempts.
And then if we go back here,
we can see that NTLM relay x sprang into life,
and the, the relay over the, SOCKS proxy succeeded.
And,
yeah, everything, looks fine there.
And then we also got a hit on the web log so we can
see the request for B.
So this is kind of telling us that well the relay worked and
the target downloaded and hopefully executed the payload.
So we can, verify that by trying to, link to it.
So we can just do link d c two,
and then the pipe name,
and there we go.
System beacon running on DC two.