Skip to content
HackIndex logo

HackIndex

NTLM Relay Conditions

3 min read May 15, 2026

Before setting up a relay attack, confirm which targets are viable. SMB relay requires SMB signing to be disabled on the target. LDAP relay requires signing and channel binding to be unenforced on the DC. WebDAV opens a relay path over HTTP even when SMB signing is enforced everywhere. Each condition is independently checkable and determines what the relay can reach.

SMB signing

SMB signing prevents relay to SMB. If signing is enforced on a host, relayed authentication to that host over SMB will be rejected. Domain controllers enforce signing by default. Workstations and member servers typically do not. For detailed signing detection methodology, see SMB Signing Not Required Detection.

┌──(kali㉿kali)-[~]
└─$ # Sweep subnet — output hosts without signing enforced to file
┌──(kali㉿kali)-[~]
└─$ nxc smb 192.168.1.0/24 --gen-relay-list targets.txt
 
┌──(kali㉿kali)-[~]
└─$ # Check single host
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD 
SMB  10.10.10.20  445  WS01  signing: False  SMBv1: False
SMB  10.10.10.30  445  WS02  signing: False  SMBv1: False
SMB  10.10.10.10  445  DC01  signing: True   SMBv1: False

Hosts listed in targets.txt are the viable SMB relay targets. DCs always enforce signing and will never appear in this list. Workstations and application servers are the primary targets.

LDAP signing and channel binding

LDAP relay to a DC allows modifying AD objects as the relayed account. Two protections block this: LDAP signing (prevents relay over plaintext LDAP) and LDAP channel binding / Extended Protection for Authentication (prevents relay over LDAPS). Both must be absent for a relay to LDAP to succeed. The ldap-checker module checks both. For the service-level check, see LDAP Signing and Channel Binding.

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker 
LDAP  10.10.10.10  389  DC01  LDAP Signing NOT Enforced
LDAP  10.10.10.10  389  DC01  Channel Binding: None
LDAP  10.10.10.10  389  DC01  Signing and Binding: Vulnerable to LDAP relay

If LDAP signing is enforced but channel binding is absent, relay to LDAPS (ldaps://) still works. ntlmrelayx handles this automatically when targeting ldaps://. If both are enforced, LDAP relay is blocked entirely — fall back to SMB or ADCS relay.

WebDAV — relay over HTTP

When the WebClient service is running on a Windows host, that host will attempt WebDAV connections over HTTP before falling back to SMB. This means you can coerce HTTP-based NTLM authentication from that host even when SMB signing is enforced — because the relay goes over HTTP, not SMB. The arriving authentication can be relayed to LDAP or ADCS.

WebClient runs on workstations by default in some environments and can be started remotely if the host is reachable. Check whether it is already running before attempting to enable it.

┌──(kali㉿kali)-[~]
└─$ # Check if WebClient is running on target
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M webdav
 
┌──(kali㉿kali)-[~]
└─$ # Sweep subnet
┌──(kali㉿kali)-[~]
└─$ nxc smb 192.168.1.0/24 -u $USER -p $PASSWORD -M webdav 
SMB  10.10.10.20  445  WS01  WebClient is running
SMB  10.10.10.30  445  WS02  WebClient is NOT running

Relay target summary

Use the findings from each check to decide what your relay setup targets. SMB signing absent on workstations means ntlmrelayx can relay to those hosts for command execution. LDAP signing unenforced means you can relay to the DC for object modification. WebDAV running means coercion over HTTP works regardless of SMB signing state.

For the relay setup and attack execution see NTLM Relay in Active Directory.

References