NTLM coercion & relay

When it applies

You're on an AD network (unauthenticated or with a foothold) and want to move laterally or escalate without cracking passwords. If SMB signing isn't enforced (or you target LDAP/ADCS), you can relay a victim's NTLM authentication to a service and act as them.

Why it works

NTLM authentication isn't bound to the channel: if you can make a machine/user authenticate to you (coercion or poisoning), you forward that authentication to another service. Without signing (SMB) or channel binding (LDAP/HTTP), the target accepts it, and you get access as the coerced identity — often a computer account with local admin elsewhere, or a DC to ADCS.

Method

1. Get victims to authenticate to you:
   • Poisoning: responder -I eth0 answers LLMNR/NBT-NS/mDNS for mistyped names → captures/relays auth.
   • Coercion: force a specific machine (esp. a DC) to auth to you — coercer, PetitPotam (MS-EFSRPC), PrinterBug (MS-RPRN), dfscoerce.
2. Find relay targets: hosts with SMB signing not required (nxc smb <range> --gen-relay-list), or LDAP/LDAPS on DCs, or the ADCS web enrollment endpoint.
3. Relay: impacket-ntlmrelayx -tf targets.txt -smb2support (SMB), -t ldaps://DC (LDAP — e.g. grant RBCD or DCSync), or -t http://CA/certsrv/certfnsh.asp --adcs (ESC8 → cert for a DC → DA, chain with ad-adcs).
4. Escalate: relayed to LDAP → set RBCD on a computer you control → impersonate DA on it; relayed to ADCS → auth as the DC.

Gotchas

• Turn off Responder's SMB/HTTP servers when using ntlmrelayx (port conflict).
• SMB signing required blocks SMB relay — pivot to LDAP/ADCS relay instead.
• Coercing a DC + ADCS ESC8 is the reliable domain-takeover combo; PetitPotam often works unauthenticated.

Verify success

Access/action as the relayed identity — a session/command on a target host, RBCD set, a cert issued for a DC, or hashes dumped — demonstrating relay-based movement/escalation.

References

impacket ntlmrelayx; SpecterOps relay research; PetitPotam/Coercer; "Certified Pre-Owned" (ESC8).