Smbrelay and Smbrelay2 collect NTLM password hashes and writes them to hashes.txt in a format usable by L0phtcrack so the passwords can be cracked later. It is an SMB man-in-the-middle attack.

SMBRelay takes advantage of the Server Message Block (SMB) file sharing protocol. SMB is layered onto NetBIOS, the networking application interface first created by IBM and adopted by Microsoft for DOS. When you share a Windows directory or drive over a local area network, you are most likely utilizing SMB over NetBIOS over NetBEUI, IPX, or TCP/IP. OK one might ask, what does DOS have to do with a modern network exploit?

Microsoft has maintained backward compatibility with its older "dialects." This backward compatibility means that when a SMB session is initiated, a more primitive "plain text" level of authentication can often be negotiated that provides for maximum exposure of the password data. Because SMB was developed to facilitate file and print sharing on local networks, a Windows client will automatically attempt to log onto an SMB server. In the process, the host and client will exchange password hashes. These pairs of password hashes, the challenge from the host plus the response from the client, can be sniffed and saved for later cracking by L0phtcrack.

The only effective way to block SMB hijacking is to use SMB signing. Unfortunately there is a performance hit. See Registry Tip #206: SMB Signing for the implementation details. If your concern is hackers coming across the firewall and using SMB session hijacking, you can block that by not allowing UDP ports 137 and 138 as well as TCP ports 139 and 445 from coming through the firewall.

Sir Dystic's SMBRelay automates the process by functioning first as a data relay between the client and host, sending on all but the authentication data. Then the attacker disconnects the client and binds the host to a new IP relay address that the attacker can log on to, all the while maintaining the original client's host privileges. At the same time NTLM password hashes exchanged by the client and host are collected and saved to a text file.

SmbRelay is setup to so that when it receives a connection on port 139, it connects back to the connecting computer's port 139, and relays the packets between the client and server of the connecting Windows machine, making modifications to these packets when necessary. After connecting and authenticating it disconnects the target's client and binds to port 139 on a new IP address. This IP address (the relay address) can then be connected to directly from windows using "net use \\192.1.1.1" and then used by all of the networking built into Windows. It relays all the SMB traffic, except for the negotiation and authentication. You can disconnect from and reconnect to this virtual IP as long as the target host stays connected. SMBRelay is multi-threaded and handles multiple connections simultaneously. It will create new IP addresses sequentially, removing them when the target host disconnects. It will not allow the same IP address to connect twice, unless a successful connection to that target was achieved and disconnected. If this happens, it may use the same relay address again for another connection.