I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting.
Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using Kerberos ticket for CIFS or NTLM. Once the server authenticates the users, it returns an UID (in SMBv1) or a Session ID (in SMBv2).
My question is, in case the SMB signing is disabled and an attacker sniffs SMB traffic, wouldn't he be able to hijack a SMB session just using the sniffed UID or Session ID in his own SMB headers on the rest of SMB packets?
Is not all this this similar with the way a NTLM Relay attack works, but without requiring the victim to connect to the attacking machine?
A bit of light on the matter would be appreciated.
Thanks and regards.