feat(smbtakeover): add smbtakeover.py module#1153
feat(smbtakeover): add smbtakeover.py module#1153sttlr wants to merge 4 commits intoPennyw0rth:mainfrom
Conversation
sttlr
requested review from
Marshall-Hallenbeck,
NeffIsBack,
mpgn and
zblurx
as code owners
There was a problem hiding this comment.
Thanks for the PR.
This code looks much better than #1152, but there are still a few things to do.
|
Now 
|
|
|
||
| # Don't disconnect on 'nxc wmi' because NetExec disconnects in the end automatically | ||
| # Disconnect only on 'nxc smb' to keep the WMI connection from hanging | ||
| if hasattr(self, f"_{self.__class__.__name__}__dcom") and self.__dcom and self.__context_protocol != "wmi": |
There was a problem hiding this comment.
Please drop the dynamic mangled-name hasattr check: initialize self.__dcom = None before the try and gate on if self.__dcom and self.__context_protocol != "wmi". Same behavior, easier to maintain.
| if name in ("srv2", "srvnet"): | ||
| table = "Win32_SystemDriver" | ||
| elif name == "LanmanServer": | ||
| table = "Win32_Service" |
There was a problem hiding this comment.
Consider a dict mapping name -> WMI class name plus table = mapping.get(name) instead of chained if/elif, less redundant and simpler to maintain if you add more entries later
| self.check() | ||
| msg = "rebind" if is_start else "unbind" | ||
| status = "restored" if is_start else "free" | ||
| self.logger.success(f"SMB {msg} sequence completed. Port 445/tcp {status}.") |
There was a problem hiding this comment.
The final success message is shown even when a WMI step failed, which can incorrectly suggest that port 445 has been properly released or restored. The success message should only be displayed if the entire sequence completes successfully
3 participants
Description
Added
smbtakeover.pymodule to unbind/rebind SMB port445/tcp. Useful when conducting NTLM relay attacks.Usually Windows hosts already use port
445/tcpfor SMB. And to conduct an NTLM relay attack you'd need port445to be available to bind to it. There are ways to do it via loading a driver, loading a module into LSASS, rebooting the target machine - which are all bad for OPSEC.This module solves this problem in an OPSEC safe way.
Original research - https://specterops.io/blog/2024/08/01/relay-your-heart-away-an-opsec-conscious-approach-to-445-takeover/
Original code - https://github.com/zyn3rgy/smbtakeover
Used Gemini Pro to generate the NXCModule class. Validated after it.
Type of change
Insert an "x" inside the brackets for relevant items (do not delete options)
Setup guide for the review
NOTE: User running the module has to have
Administratorlevel access on the machine (to start/stop the services).NOTE: WMI ports need to be accessible (check firewall).
I used
Kaijuchain from Vulnlab to validate the module.Screenshots (if appropriate):
Unbinding and then rebinding works ok.
Checklist:
Insert an "x" inside the brackets for completed and relevant items (do not delete options)
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)