# NTLM Relay, ADCS & SQL Server Trust

> Coerce authentication, relay to SMB or LDAP for RBCD, abuse ADCS ESC8 for certificate takeover, and pivot MSSQL instances via linked-server trust.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 12
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

Three primitives that each turn an unauthenticated or low-privilege foothold into Domain Admin: NTLM relay chains, ADCS certificate abuse, and SQL Server trust exploitation. All three exploit systems that trust something they should not. PT2 tests whether you can enumerate the pre-conditions, coerce or capture the authentication, and chain the primitive into forest-wide compromise.

## Pre-conditions

Relay viability lives on three independent switches: SMB signing not required (member servers), LDAP signing or channel binding not enforced (domain controllers), and WebDAV accessible when direct SMB relay is blocked. ADCS requires at least one enrollable template with a specific misconfiguration (ESC1-ESC10). SQL Server trust abuse needs linked servers between instances or impersonation grants on a reachable login. All three sets of pre-conditions are enumerable before any attack fires.

## Coerce, Relay, Pivot

PrinterBug (MS-RPRN), PetitPotam (MS-EFSRPC), and DFSCoerce force a target machine account to authenticate to an attacker-controlled host. ntlmrelayx receives that authentication and forwards it: to SMB for immediate command execution on a signing-less target, to LDAP for RBCD or Shadow Credentials, or to the ADCS web enrollment endpoint to mint a certificate for the coerced machine account (ESC8). The certificate authenticates via PKINIT, pulls a TGT, and the chain lands at Domain Admin on any DC enrolled in the vulnerable template.

## ADCS Beyond ESC8

ESC1 (SAN control), ESC2 (any purpose EKU), ESC3 (enrollment agent abuse), ESC4 (writable template ACL), ESC6 (CA-level EDITF flag), ESC7 (CA role assignment), ESC9 (NO_SECURITY_EXTENSION on a certificate mapped user), and ESC10 (weak mapping config) each give a different path to a cert that authenticates as a target principal. Certipy enumerates all of them in one pass and executes most without manual intervention.

## SQL Server Trust

Linked servers between MSSQL instances allow queries, procedure calls, and (with RPC_OUT enabled) direct command execution to pivot through a trust chain. Chained linked servers walk forest boundaries that NTLM alone cannot. MSSQL also leaks credentials: `xp_dirtree` and `xp_fileexist` force the service account to authenticate to an attacker SMB share, netting NetNTLMv2 to crack or relay. Impersonation grants on `sa` or TRUSTWORTHY-enabled databases escalate inside the instance to full sysadmin.

## Chaining

These three stacks compose cleanly. SQL Server credential capture → NTLM relay to ADCS → DA. ADCS certificate → Pass-the-Certificate for lateral movement → more SQL coercion deeper in the forest. The exam rewards picking the shortest viable chain for the trust map you enumerated.

## Study material

- [NTLM Relay Conditions](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ntlm-relay-conditions.md) (read, core)
- [Coercion Attacks in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-attacks.md) (read, core)
- [Coercer and PetitPotam — Active Directory Coercion Frameworks](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-with-coercer-and-petitpotam.md) (read, core)
- [NTLM Relay in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay.md) (read, core)
- [ADCS Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/adcs-misconfiguration-discovery.md) (read, core)
- [ADCS Exploitation: ESC1, ESC4, ESC6, ESC8](https://hackindex.io/platforms/active-directory/exploitation/adcs-exploitation.md) (read, core)
- [ESC8 — NTLM Relay to AD CS Web Enrollment](https://hackindex.io/platforms/active-directory/exploitation/adcs-esc8-ntlm-relay.md) (read, core)
- [RBCD – Resource-Based Constrained Delegation Abuse](https://hackindex.io/platforms/active-directory/exploitation/rbcd-resource-based-constrained-delegation.md) (read, core)
- [Pass-the-Certificate](https://hackindex.io/platforms/active-directory/lateral-movement/ad-pass-the-certificate.md) (read, core)
- [MSSQL Credential Capture via Forced Authentication](https://hackindex.io/services/mssql/exploitation/mssql-credential-capture-via-forced-authentication.md) (read, core)
- [Lateral Movement via MSSQL Linked Servers](https://hackindex.io/services/mssql/lateral-movement/lateral-movement-via-mssql-linked-servers.md) (read, core)
- [MSSQL Privilege Escalation via Impersonation](https://hackindex.io/services/mssql/exploitation/mssql-privilege-escalation-via-impersonation.md) (read, core)