Hey @jfjallid,

sorry late response on this one!

Been playing a bit with the scenario you mention and wasn't able to trigger the exception. Although it makes sense what you comment...
Do you have some pcaps you can share with us to check? I'm pretty sure I'd be missing something

Tested both with Impacket's smbclient and Linux's smbclient and MessageID sequence was the same

let me know, thanks!!

Hi @gabrielg5

No worries, I've been busy so haven't had time to follow up until now.

I've attached three pcapng files to cover the different scenarios.
My lab setup is as follows:

• WIN2K19 is a windows host with ip 100.100.100.45 and this is the target.
• ADSRV01 is a windows host with ip 100.100.100.47 and the local administrator account on this host shares local admin password with WIN2K19 (which is why authentication is successful).
• Attacker/dev is a linux host with ip 100.100.100.51 which is running ntlmrelayx.py with socks enabled and a specified target of 100.100.100.45

All the wireshark dumps are from the attacker machine.

In the file nopatch-smbclient-not-working.pcapng I run the unmodified version of ntlmrelayx.py and connect with proxychains smbclient -U "ADSRV01/Administrator" -N -L \\100.100.100.45
This fails as the MessageId in the server response is 1 instead of 0 as the client expects.

In the file nopatch-smbclient.py-working.pcapng I run the unmodifed version of ntlmrelayx.py and connect with proxychains ./smbclient.py ADSRV01/Administrator@100.100.100.45 -n
This works as smbclient.py begins with SMB1 protocol negotiation which the ntlmrelayx.py server is expecting so the hardcoded MessageId of 1 in response to the second NegotiateProtocol request will be in sync with the client.

Finally, in patched-smbclient-working.pcapng I run ntlmrelayx.py with my patch and connect with proxychains smbclient -U "ADSRV01/Administrator" -N -L \\100.100.100.45
This works as the ntlmrelayx.py smb server/relay will respond with a correct MessageId of 0 to the NegotiateProtocol request.

pcaps.zip

Hey, thanks for the details!

Finally was able to understand what was wrong with my tests.
I was using Kali which smbclient comes with support for old SMB protocols by default. Changed that property in the smb.conf file and am now able to replay the same scenario you had.

Will be doing some tests and merge today if everything goes ok

thank you!