Skip to content

Fix the smb_to_ldap module's missing target option #20118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

zeroSteiner
Copy link
Contributor

When PR #19639 was landed it removed the RELAY_TARGETS datastore option because it was no longer necessary and instead changed the pattern to use RHOSTS as most modules do. That particular PR took a while to land and in the mean time the smb_to_ldap relay module was submitted. By the time RELAY_TARGETS were removed, the smb_to_ldap module had already been landed but had not been updated resulting in it currently being broken. This PR fixes the smb_to_ldap module by registering the RHOSTS option.

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • use auxiliary/server/relay/smb_to_ldap
  • set RHOSTS to the LDAP server
  • Test the module and see that it works

For the victim system that is being relayed from, the original PR #19832 has a helpful note about how to make it vulnerable:

The Domain Computer will need to be configured to use NTLMv1 by setting the following registry key to a value less or equal to 2:

PS > reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa -v LmCompatibilityLevel /t REG_DWORD /d 0x2 /f
PS > reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa -v LmCompatibilityLevel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
    LmCompatibilityLevel    REG_DWORD    0x2

I found this insufficient however. A Windows 11 24H2 build 26100 system wasn't able to work. I was able to get a Server 2019 v1809 build 17763 server to work though. My best guess is that instructions require a system less than something between builds 17763 and 26100. @jheysel-r7 noted that his test system at the time was build 19045, so more accurately, it's probably 19045 - 26100.

@msutovsky-r7 msutovsky-r7 self-assigned this May 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants