NTLM Relay
Use a driver to redirect traffic destined for port 445 to another port (e.g. 8445) that we can bind to.
Use a reverse port forward on the port the SMB traffic is being redirected to. This will tunnel the SMB traffic over the C2 channel to our Team Server.
The tool of choice (ntlmrelayx) will be listening for SMB traffic on the Team Server.
A SOCKS proxy is required to allow ntlmrelayx to send traffic back into the target network.
NTLM Authentication
1x1 Images in Emails
If you have control over an inbox, you can send emails that have an invisible 1x1 image embedded in the body. When the recipients view the email in their mail client, such as Outlook, it will attempt to download the image over the UNC path and trigger an NTLM authentication attempt.
Windows Shortcuts
A Windows shortcut can have multiple properties including a target, working directory and an icon. Creating a shortcut with the icon property pointing to a UNC path will trigger an NTLM authentication attempt when it's viewed in Explorer (it doesn't even have to be clicked).
The easiest way to create a shortcut is with PowerShell.
A good location for these is on publicly readable shares.
Last updated