"If this attack involves "simply sniffing TCP 445" why not just MITM the whole session?" Because it doesn't. The attack involves using a bug in IE (an iframe w

"If this attack involves "simply sniffing TCP 445" why not just MITM the whole session?" Because it doesn't. The attack involves using a bug in IE (an iframe will render cookie data from the local computer) with clickjacking to steal cookie information. Sniffing on port 445 is only mentioned in the context of figuring out the username of your target (by causing the target to connect to your SMB server, running on port 445). I'd suggest you go back and re-read the whole page before making sweeping generalizations.