I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting.

Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using Kerberos ticket for CIFS or NTLM. Once the server authenticates the users, it returns an UID (in SMBv1) or a Session ID (in SMBv2).

My question is, in case the SMB signing is disabled and an attacker sniffs SMB traffic, wouldn't he be able to hijack a SMB session just using the sniffed UID or Session ID in his own SMB headers on the rest of SMB packets?

Is not all this this similar with the way a NTLM Relay attack works, but without requiring the victim to connect to the attacking machine?

A bit of light on the matter would be appreciated.

Thanks and regards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.