I'm not sure what you mean - as stated in the article, and the linked blackhat presentation, this has been broken and exploited for 15 years: https://github.co

I'm not sure what you mean - as stated in the article, and the linked blackhat presentation, this has been broken and exploited for 15 years: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/smb_relay.rb https://github.com/rapid7/metasploit-framework/blob/master/m... and/or: https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/windows/smb/psexec.md https://github.com/rapid7/metasploit-framework/blob/master/d... Getting a hash is rather simple, if you already have access to the lan, assuming you are able to redirect traffic or insert yourself between the target user and the network (say, false wifi ap): https://shellgam3.com/2016/03/14/capturing-and-cracking-ntlmv2-hashes/ https://shellgam3.com/2016/03/14/capturing-and-cracking-ntlm... I'm generally not much of fan of firewalls (precisely because they by definition set up a "soft core" that's assumed to be safe) - but egress filtering of smb packets is unfortunately necessary if you have an winodws (and/or smb/cifs) clients on your network. I would much rather only run boxes that are "fit for the Internet" - but that's been rather difficult to do with windows for the past decades. In fairness, Microsoft has made a number of improvements - but still not enough. It would be nice if there was an easy way to set up the network so all clients used only kerberos5, and only sent credentials to kerberos principals in a trusted domain. As far as I know, there is no such easy way.