Quick and easy way to get domain usernames while on an internal network.
Hit me up: @skorov8
How it works
RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps:
- Spins up an SMB and HTTP servers and waits for an incoming connection
- The incoming credentials are relayed to a specified target, creating a connection with the context of the relayed user
- Queries are made down the SMB connection to the lsarpc pipe to get the list of domain usernames. This is done by cycling up to 50000 RIDs
- The password policy is extracted through the samr pipe
(For best results, use with Responder)
- Python 2.7 (sorry but impacket doesn't play nice with 3 :( )
- Impacket v0.9.17 or above
pipenv install --two pipenv shell # Optional: Run if installing impacket git submodule update --init --recursive cd submodules/impacket pip install . cd ../..
First, find a target host to relay to. The target must be a member of the domain and MUST have SMB Signin off. CrackMapExec can get this info for you very quick!
Start RidRelay pointing to the target:
python ridrelay.py -t 10.0.0.50
Also output usernames to file
python ridrelay.py -t 10.0.0.50 -o path_to_output.txt
Highly Recommended: Start Responder to trick users to connecting to RidRelay
Mad props go to:
- Ronnie Flathers (@ropnop) - Original idea on low priv smb relaying
- Add password policy enumeration DONE
- Dynamic relaying based on where incoming creds have admin rights
- Getting active sessions???
- Connect with Bloodhound???