NTLM relay: forwarding the authentication elsewhere

May 20, 2025 · 1 min read · #active-directory #ntlm #relay

NTLM is a challenge-response. In a relay the attacker cracks nothing: they bridge the victim authenticating and a target service, forwarding the messages.

The flow

With LLMNR poisoning or coercion (PetitPotam, PrinterBug) the victim authenticates to the attacker, who forwards the NTLM session to another host (SMB, LDAP, ADCS). If the victim is privileged on the target, the attacker inherits that access.

ntlmrelayx.py -t ldap://dc --escalate-user bob
# relay to ADCS -> certificate -> TGT (ESC8)

Defence

Mandatory SMB signing (blocks SMB relay). LDAP signing/channel binding. EPA on ADCS/HTTP. Disable NTLM where possible. Fix coercions (patches, RPC filtering).

« back to home