Create article for SMB and stub for SMB relay attack

Author: RandomChugokujin

content/en/docs/active_directory/_index.md

@@ -0,0 +1,9 @@
+---
+title: Active Directory
+description: Active Directory
+categories: [Active Directory]
+tags: [Active Direcotory, Initial Access]
+weight: 2
+---
+
+Active Directory

content/en/docs/active_directory/initial_access/_index.md

@@ -0,0 +1,9 @@
+---
+title: Active Directory Initial Access
+description: Enumeration
+categories: [Active Directory]
+tags: [Active Direcotory, Initial Access]
+weight: 2
+---
+
+Initial Access on Microsoft Active Directory domain involves finding a first set of credential or finding access to the first service within an Active Directory network.

content/en/docs/active_directory/initial_access/smb_relay.md

@@ -0,0 +1,29 @@
+---
+title: SMB Relay Attack
+description: SMB Relay Attack
+categories: [Active Directory]
+tags: [Active Direcotory, Initial Access, SMB, NTLM Authentication]
+weight: 2
+---
+
+{{% alert title="Note" %}}
+This article is under construction. Information presented is not complete.
+{{% /alert %}}
+
+SMB still supports NTLM authentication. The authentication flow goes as follows:
+1. Client calculates NTLM hash from the user's password and sends the username to the server.
+2. Server returns a random number called *nounce* as a **challenge**.
+3. Client completes the challenge by encrypting the nounce using the NTLM hash and sending the **response** to the server.
+4. If not part of an AD domain, the server encrypts the nounce itself and compare it to the ciphertext supplied by the client. If part of the AD domain, the server sends the client response to the **Domain Controller**, who does the comparison and tells the server if the response match or not.
+5. If there is a match, the client is successfully authenticated.
+
+This authentication follow is suspetible to a **Man-in-the-Middle** attack called SMB relay. The flow of the attack goes as follows:
+1. Client initates connection to an **attacker controlled relay**.
+2. Attacker relay connects to target server, relay client's username to target
+3. Server responds the attacker relay with **NTLM challenge**.
+4. Attacker relays the **NTLM challenge** to the client.
+5. Client completes the challenges, sends attacker relay the **NTLM response**.
+6. Attacker relays client's **NTLM response** to the target server.
+7. Target server checks the response. If it's correct, access is granted to attacker relay.
+
+TODO: Create Dedicated article for SMB relay attack

content/en/docs/services/nfs.md

@@ -12,7 +12,7 @@ weight: 2
 - Listening port: **111 TCP/UDP**, **2049 TCP/UDP**
 - OS: Unix-Like
 
-Network File System (NFS) is developed by Sun Microsystems in 1984, allowing a user to access files over the network as much like local storage. It builds on the **Open Network Computing Remote Procedure Call (ONC-RPC/SUN-RPC)** that listens on port 111 of both UDP and TCP.
+**Network File System (NFS)** is developed by Sun Microsystems in 1984, allowing a user to access files over the network as much like local storage. It builds on the **Open Network Computing Remote Procedure Call (ONC-RPC/SUN-RPC)** that listens on port 111 of both UDP and TCP.
 
 NFS versions:
 - NFSv2: Released in March 1989, Operates entirely via UDP