SMB/CIFS (file sharing, Windows environment)

I understand when a client connects to a server there is a challenge/response system in place. However, once the client is connected that "connection" is authenticated. At this point, couldn't a man-in-the-middle(like) [or rather a network level] attack spoofing the connected session's IP and port submit arbitrary commands.

Does the server consider the "IP:port" authenticated, or is there more to it?

  • SMB is encrypted so it would be difficult for it to be MiTM'd. Commented Jun 16, 2014 at 19:33
  • I believe SMB 3.0 allows for encryption. Any idea about 1 and 2 which lacked this?
    – Nathan
    Commented Jun 16, 2014 at 19:41
  • You'd have to spoof the sequence numbers, and if the real client sent data too I expect the connection would go into an invalid state as the data stream wouldn't match up. Commented Jun 16, 2014 at 19:48

2 Answers 2


If the connection is unencrypted then nothing prevents this, just a lack of generic toolkit. Metasploit can handle it as can SMBRelay (never used the latter). But for example, the metasploit payload can intercept (relay) the authentication then run arbitrary code on the server.


I may have misunderstood your question though. I'm not aware of anything that modifies the files on the fly but I dont see why it would be impossible.

Addtionally: Encryption will only help here if the server is signed, otherwise the user will not be aware if they are connecting to the correct server or the malicious one.


SMB packets can be signed to prevent this. You can ensure security by configuring Windows to require signing (and perhaps NTLMv2) using Group Policy.

By default, Windows only uses signing to protect communication with the Domain Controller.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .