How SMB Works: Windows File Sharing, NTLM Relay & EternalBlue (Animated)

SMB is how Windows machines share files and printers: every time you open \\server\share, SMB is at work. It is also the most attacked protocol inside corporate networks, from WannaCry’s EternalBlue exploit to NTLM relay attacks.

1. Negotiate: which smb version shall we use?

The client connects to port 445 and both sides agree on the newest SMB version (dialect) they share.

1. NEGOTIATE (Office PC → File server): The client offers the versions it speaks.
2. NEGOTIATE (File server → Office PC): The server picks 3.1.1. Note “signing not required”: that weakness matters later.

Wireshark filter:

smb2.cmd == 0

2. Log in: session setup

The user authenticates, here with NTLM (challenge and response). In a domain, Kerberos is normally used instead.

1. SESSION SETUP (Office PC → File server): The client starts the login.
2. SESSION SETUP (File server → Office PC): The server sends a random challenge.
3. SESSION SETUP (Office PC → File server): The client proves it knows the password without sending it.
4. SESSION SETUP (File server → Office PC): Logged in.

Wireshark filter:

smb2.cmd == 1

3. Open the share: tree connect, open, read

The client connects to a share (a “tree”), opens a file and reads it.

1. TREE CONNECT (Office PC → File server): Which shared folder.
2. CREATE (Office PC → File server): “Create” is SMB’s word for opening a file.
3. READ (File server → Office PC): The file contents arrive.

Wireshark filter:

smb2.cmd == 3 || smb2.cmd == 5 || smb2.cmd == 8

4. Ntlm relay: attack: pass the victim’s login to the server

The attacker tricks a PC into authenticating to him (for example by poisoning name lookups with Responder), then forwards that login to the file server in real time.

1. SESSION SETUP (Office PC → Attacker (same LAN)): The PC thinks the attacker is a file server and starts logging in.
2. RELAY (Attacker (same LAN) → File server): The attacker passes the server’s challenge to the victim and the victim’s answer back to the server.
3. SUCCESS (File server → Attacker (same LAN)): The server accepts. The attacker has priya’s access without knowing her password.

Wireshark filter:

ntlmssp

5. Smb signing: defence: sign every message

With signing required, every message must be signed with a key only the real user’s machine can derive. Also disable SMBv1 and block port 445 at the internet edge.

1. RELAY (Attacker (same LAN) → File server): The relay authenticates but can’t sign anything afterwards, so the session is useless.

Group policy:

Microsoft network server: Digitally sign communications (always) = Enabled
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

FAQ