A few hours into an internal engagement and the foothold has produced nothing exciting yet. No cached admin credentials, no obvious misconfiguration jumping out of the initial recon, and the clock on a fixed-scope engagement doesn't pause for a quiet subnet. The routine move is a sweep for SMB across the network, port 445, followed by the less exciting second pass: checking signing status host by host. Most of it comes back unremarkable. Then a run of workstations, older ones mostly, come back with SMB signing not required.
That single column is the difference between a dead end and a path forward, and it's easy to miss because it isn't part of the same output as "is the port open." A basic port sweep tells you SMB is listening. It says nothing about whether the machine will accept a relayed authentication attempt, and that second question is the one that actually matters here.
Windows machines authenticate outbound over NTLM constantly, for reasons that have nothing to do with an attacker: print spoolers checking in, services polling shares, all sorts of mundane background traffic. Coerce one of those authentication attempts toward a listener you control, or just wait for one to happen naturally, and you're holding a captured NTLM authentication. Without signing enforced on the receiving end, that capture doesn't have to be cracked offline, hoping for a weak password. It can be relayed immediately to a different host that will accept it as legitimate, and you're authenticated as that identity somewhere else in the network the moment the relay lands.
Signing is what closes this specific gap. When it's enforced, the authentication is cryptographically tied to the exact connection it was made on, so it can't just be forwarded to a second target and accepted as valid there. That's the entire practical difference between "I have a hash, now I need to crack it" and "I am now authenticated, no cracking required," and it's a difference that lives entirely in a setting most enumeration checklists don't separately verify.
Part of why this keeps showing up: domain controllers enforce SMB signing by default. Regular workstations don't, signing on a workstation is merely negotiated unless a GPO explicitly turns on the requirement, and that GPO has a habit of not reaching every machine in a large, aging domain uniformly. The ten-year-old workstation in a back office that never got re-imaged is exactly the kind of host this shows up on, and it's rarely the one anyone thinks to check first.
The actual habit worth building: don't stop enumeration at "what's listening." For every host with SMB open, check signing status as its own separate data point, and pay particular attention to anything outside the DCs. On the defensive side, the fix is enforcing signing domain-wide through GPO rather than assuming the default DC posture covers the rest of the estate, because it doesn't.
Codelivly's Internal Network Penetration Testing Book walks this exact arc end to end, host enumeration through lateral movement to a client-ready report, the same chain a signing gap like this one sits in the middle of. The free Credential Attacks learning path on codelivly.com is a solid place to build the muscle of treating credential capture and relay as one continuous problem instead of two separate steps.
Top comments (0)