Skip to content

Metasploit Wrap-Up 03/27/2026 #2061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
carlospolop wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Metasploit Wrap-Up 03/27/2026 #2061

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion ...pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,21 @@ python3 relayking.py --null-auth --protocols smb,ldap,http --proto-portscan -o p

These tools and techniques form a comprehensive set for conducting NTLM Relay attacks in various network environments.

### Metasploit SMB relay: client compatibility and single-vs-multi target behavior

Metasploit's SMB relay server has an **important client-behavior dependency** when you try to relay **one inbound SMB authentication to multiple targets**. The classic multi-target flow depends on the SMB client reacting to `STATUS_NETWORK_SESSION_EXPIRED` like Windows `net use` does. Many clients do **not** retry in the required way, so the relay can fail even when the targets themselves are relayable.

Operationally, this means:

- **Single relay target**: Metasploit can **forward the Net-NTLM messages immediately** instead of depending on the client to recover from `STATUS_NETWORK_SESSION_EXPIRED`. This improves compatibility with clients such as Linux `smbclient`.
- **Multiple relay targets**: reliability still depends on the **client-side retry semantics**. If the authenticating client behaves like Windows `net use`, one inbound auth can be replayed against multiple downstream targets more reliably.
- **RubySMB-originated auth**: recent RubySMB changes mimic `net use`, so **RubySMB clients can participate in multi-target relay flows** that previously failed.

Practical takeaway:

- If a relay works from `net use` but fails from another SMB client, test the **same target set with only one relay destination** before assuming SMB signing or target hardening is blocking you.
- When validating a relay path in Metasploit, distinguish between **target-side protections** and **source-client incompatibility**. A failed multi-target run may still be exploitable with a single-target configuration.

### Abusing WSUS HTTP (8530) for NTLM Relay to LDAP/SMB/AD CS (ESC8)

WSUS clients authenticate to their update server using NTLM over HTTP (8530) or HTTPS (8531). When HTTP is enabled, periodic client check-ins can be coerced or intercepted on the local segment and relayed with ntlmrelayx to LDAP/LDAPS/SMB or AD CS HTTP endpoints (ESC8) without cracking any hashes. This blends into normal update traffic and frequently yields machine-account authentications (HOST$).
Expand Down Expand Up @@ -351,6 +366,6 @@ You now own **NT AUTHORITY\SYSTEM**.
- [Microsoft – WSUS deprecation announcement](https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-server-update-services-wsus-deprecation/4250436)
- [RelayKing v1.0](https://github.com/depthsecurity/RelayKing-Depth)
- [Depth Security – Introducing RelayKing: Relay to Royalty](https://www.depthsecurity.com/blog/introducing-relayking-relay-to-royalty/)
- [Rapid7 – Metasploit Wrap-Up 03/27/2026](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-03-27-2026/)

{{#include ../../banners/hacktricks-training.md}}