Skip to content
HackIndex logo

HackIndex

SMB Signing Not Required Detection

2 min read May 15, 2026

If SMB signing is not required, the host is a relay candidate. That matters because relayed authentication can turn a passive capture or coerced auth event into remote actions on the target, depending on what the relayed identity can do.

Start with the signing checks.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-security-mode,smb2-security-mode $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP 
| smb2-security-mode:
|   3.1.1:
|     Message signing enabled but not required

If signing is enabled but not required, keep the host in scope for relay paths. If signing is required, SMB relay against that target is usually not worth more time.

Check the protocol mix at the same time.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 445 --script smb-security-mode,smb2-security-mode,smb-protocols $TARGET_IP

If the host also supports SMBv1, the SMB posture is weaker overall and legacy checks become more relevant.

If you already have credentials, confirm the host is still interesting in a real session.

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u "$USER" -p "$PASSWORD"
┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -U "$USER%$PASSWORD"

Authenticated access does not change the signing result, but it does change priority. A reachable host that accepts valid sessions and does not require signing is a much stronger relay target than an isolated unauthenticated service.

What changes your next move is simple. If signing is required, move on to shares and access control. If signing is not required, document it as relay exposure and check whether that condition exists broadly across servers, workstations, or both.

For executing the relay against identified targets, see SMB NTLM Relay and AD NTLM Relay.

References