NTLM Relay and Authentication Coercion Playbook

Problem Scope

In network penetration testing, a common bottleneck after initial foothold is elevating from scattered low-value credentials to meaningful access. NTLM authentication may be triggered through LLMNR, NBT-NS, WPAD, or mDNS, but relayability depends on protocol signing, EPA, channel binding, and cross-protocol constraints. General models often miss these distinctions and incorrectly treat every capture as hash-cracking.

How It Works

This skill organizes the chain into practical decision points:
- Credential capture: use Responder for poisoning responses and decide between offline cracking and direct relay.
- Target selection: evaluate SMB, LDAP, LDAPS, HTTP (ADCS), MSSQL, IMAP/SMTP, and RPC for permissions, default signing, and channel binding.
- Relay execution: forward captured authentication to SMB, LDAP, ADCS, or MSSQL with tools like NTLMRelayX; combine with mitm6 where IPv6 DNS takeover is relevant.
- Authentication coercion: trigger targets to initiate NTLM via WebDAV, PetitPotam, PrinterBug, DFSCoerce, and similar methods, using WebClient to convert SMB-style coercion into an HTTP path when useful.

Boundaries and Notes

This material is for authorized red-team and penetration-testing work. In production, treat it as a detection checklist: monitor abnormal Responder traffic, cross-protocol NTLM authentications, unusual ADCS enrollment, xp_cmdshell usage, and LDAP changes related to RBCD or shadow credentials.