--disable-multi parameter

[Hackndo]

Context

As explained in issue #794, newer versions of Windows disable SMB guest authentication by default.

https://support.microsoft.com/en-us/help/4046019/guest-access-in-smb2-disabled-by-default-in-windows-10-and-windows-ser

Since guest access is disabled by default, the server doesn't open an SMB session after authentication, and thus does not request a tree ID.
It means the first authentication (not relayed because of multi-target feature) will be discarded, and the STATUS_NETWORK_SESSION_EXPIRED will never be sent because the client never requested a Tree.

Older versions of impacket directly relayed the 1st authentication, so it worked because from the client's point of view, this was an authenticated access.

Fix

This PR adds a --disable-multi parameter to ntlmrelayx so that it relays the 1st received authentication, like it did before.

Example

Here's a simple example in my lab.

Note

As I said to @asolino already, I don't have the full picture. It may be incomplete, as it may break some existing features/constraints I'm not aware of.

[mohemiv]

I also have a problem with it, but I relay Unix Samba / smbclient.py. I might suggest not just relay the connection, but detect the SMB client version and use the implemented multi-relay only when applicable.

[Hackndo]

Fixed in 9f69ffa