SMB Penetration Testing — NTLM Relay Attack

Red Team Lab — NTLM Relay via LLMNR Poisoning, CVE-2007-2447, NTLMv2 Hash Cracking & NT AUTHORITY\SYSTEM on Windows 10

---

Author

Field	Details
Name	Younes
GitHub	@Youneskc
Type	Penetration Testing Lab
Status	Completed

---

Legal Disclaimer

This project was conducted exclusively within an isolated laboratory environment for educational and research purposes only.
All systems tested are privately owned by the author.
No external networks, production systems or third-party infrastructure were involved.
All activities comply with applicable laws and ethical guidelines governing cybersecurity research.

---

Project Overview

This lab documents a complete SMB attack chain against a Windows 10 target, covering three phases:

• Phase 1 — Reconnaissance : SMB enumeration, service fingerprinting, vulnerability identification
• Phase 2 — Exploitation : NTLM Relay attack via Responder + ntlmrelayx, NTLMv2 hash cracking
• Phase 3 — Post-Exploitation : NT AUTHORITY\SYSTEM shell, SAM dump, Pass-the-Hash, persistence

---

Lab Environment

Machine	Role	IP
Kali Linux	Attacker / C2	192.168.1.50
Windows 10 Pro Build 19045	Target	192.168.1.20
Network	Host-Only VirtualBox	192.168.1.0/24

---

Attack Chain

LLMNR/NBT-NS Poisoning (Responder)
        ↓
NTLMv2 Hash Captured
        ↓
Hash Cracked in 2 seconds (Hashcat + rockyou.txt)
        ↓
Password Spray → administrateur:younes (Pwn3d!)
        ↓
Interactive Shell via psexec → NT AUTHORITY\SYSTEM
        ↓
SAM Database Dumped (secretsdump)
        ↓
Pass-the-Hash + Persistence (backdoor account)

---

Vulnerabilities Found

ID	Vulnerability	CVSS	Severity
F-01	SMB Message Signing Disabled	9.8	CRITICAL
F-02	SMBv1 Protocol Enabled	8.1	HIGH
F-03	NTLMv2 Hash Cracked in 2 Seconds	9.3	CRITICAL
F-04	Password Reuse (Admin = User)	7.5	HIGH
F-05	Full SYSTEM Shell via psexec	10.0	CRITICAL
F-06	All Hashes Extracted (secretsdump)	9.8	CRITICAL
F-07	Persistent Backdoor Account	9.1	CRITICAL

---

Repository Structure

SMB-Penetration-Testing-NTLM-Relay/
│
├── reconnaissance/       # Nmap, enum4linux-ng, CrackMapExec screenshots
├── exploit/              # Responder, ntlmrelayx, Hashcat, CME screenshots
├── postexploit/          # psexec, secretsdump, Pass-the-Hash, persistence screenshots
└── report/               # Full penetration test report (DOCX)

---

Tools Used

Tool	Purpose
Nmap	Port scanning, NSE scripts
enum4linux-ng	SMB enumeration
CrackMapExec	Fingerprinting, password spraying
Responder	LLMNR/NBT-NS poisoning
ntlmrelayx (Impacket)	NTLM relay
Hashcat	NTLMv2 hash cracking
psexec.py (Impacket)	Remote shell
secretsdump.py (Impacket)	SAM extraction

---

MITRE ATT&CK Mapping

Technique ID	Name
T1557.001	LLMNR/NBT-NS Poisoning and Relay
T1110.002	Password Cracking
T1110.003	Password Spraying
T1003.002	SAM Database Dump
T1550.002	Pass the Hash
T1569.002	Service Execution (psexec)
T1136.001	Create Local Account (persistence)

---

Key Finding

Enabling SMB Message Signing alone would have prevented this entire attack chain.
Set-SmbServerConfiguration -RequireSecuritySignature $true

---

Educational lab — Isolated environment — No real systems were harmed