ntlm-relay-coercion

A technical playbook documenting NTLM relay and authentication-coercion techniques used in Active Directory penetration testing and red-team assessments. It explains the relay flow, in which a coerced or poisoned victim's NTLM authentication is forwarded through an attacker to a target that accepts it, and contrasts NTLMv1 and NTLMv2 in terms of relayability and crackability.

A relay-target matrix summarizes what each protocol yields and its default protections: SMB (command execution when admin, signing required on domain controllers), LDAP and LDAPS (ACL modification, RBCD, shadow credentials, adding computers, with channel binding on LDAPS), HTTP for ADCS (certificate enrollment, ESC8), MSSQL (queries and xp_cmdshell), and others. Signing checks are shown with crackmapexec and nmap.

Credential capture and poisoning are covered with Responder (LLMNR, NBT-NS, WPAD, mDNS), including how to disable its HTTP and SMB servers so ntlmrelayx handles relaying instead. ntlmrelayx usage spans SMB execution, SAM dumping, and SOCKS sessions; LDAP-based delegate-access (RBCD), shadow credentials, computer creation, and domain dumps; ADCS HTTP relay for certificates; and MSSQL command execution. mitm6 is described as an IPv6/DHCPv6 DNS-takeover primitive that pairs with WPAD to trigger authentication for relay.

Cross-protocol relay is addressed (SMB to LDAP and WebDAV to LDAP), along with the SMB-signing constraints that limit it and how WebDAV's HTTP-based NTLM, via the WebClient service, sidesteps them. A decision tree helps choose capture method and relay target based on whether code execution, domain escalation, or certificate access is the goal, and the playbook cross-references companion material on coercion methods (PetitPotam, PrinterBug, DFSCoerce), ADCS, ACL abuse, Kerberos attacks, and lateral movement. It is presented as reference material for authorized security testing.