SMB Analysis

SMB stands for Server Message Block.

It is an application-layer protocol, which is commonly used to provide file and printer sharing services. Moreover, it is also capable of handling the shared services between serial ports and laid miscellaneous communications between different nodes on the network. It is also known as CIFS (Common Internet File System).

SMB is purely based on a client-server architecture and has been implemented on various operating systems such as Linux and Windows.

Network Basic Input Output System(NetBIOS) is an integral part of the SMB protocol, which implements the transport service on Windows systems. If someone is using an outdated version of SMB shares, we can also use this vulnerability and exploit it to gain access.

A brief discussion on SMB Relay Attack.

SMB Relay Attack is a type of attack which relies on NTLM Version 2 authentication that is normally used in most companies. Unfortunately, when we are listening to what is going on in the network, we’re able to capture a certain part of the traffic related to the authentication and also relay it to the other servers. We can look at this from two different perspectives: the good and the bad depending on who is listening on.

The good perspective is when the actual user is the one trying to authenticate. The bad scenario comes up when a hacker is listening to the network in order to authenticate as one of the users and there is no password needed.

I’ll also recommend this video, for understanding SMB relay attack

In Kali Linux, there are three tools pre-installed for SMB analysis…Let’s learn about them.