# NTLM Relay Conditions

> Covers conditions enabling NTLM relay attacks in AD environments, including signing requirements, EPA configurations, and protocol-level mitigations to assess.

- **URL:** https://hackindex.io/platforms/active-directory/vulnerability-discovery/ntlm-relay-conditions
- **Path:** Active Directory > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Before setting up a relay attack, confirm which targets are viable. SMB relay requires SMB signing to be disabled on the target. LDAP relay requires signing and channel binding to be unenforced on the DC. WebDAV opens a relay path over HTTP even when SMB signing is enforced everywhere. Each condition is independently checkable and determines what the relay can reach.

- SMB signing: sweep for hosts without signing enforced (`--gen-relay-list`)
- LDAP signing: check if the DC enforces LDAP signing on plaintext connections
- LDAP channel binding: check if Extended Protection blocks relay over LDAPS
- WebDAV/WebClient: identify hosts where HTTP-based coercion bypasses SMB signing

## SMB signing

SMB signing prevents relay to SMB. If signing is enforced on a host, relayed authentication to that host over SMB will be rejected. Domain controllers enforce signing by default. Workstations and member servers typically do not. For detailed signing detection methodology, see [SMB Signing Not Required Detection](https://hackindex.io/services/smb/vulnerability-discovery/smb-signing-not-required-detection).

**Identify hosts without SMB signing**

```bash
# Sweep subnet: output hosts without signing enforced to file
nxc smb 192.168.1.0/24 --gen-relay-list targets.txt

# Check single host
nxc smb $TARGET_IP -u $USER -p $PASSWORD
# SMB  10.10.10.20  445  WS01  signing: False  SMBv1: False
# SMB  10.10.10.30  445  WS02  signing: False  SMBv1: False
# SMB  10.10.10.10  445  DC01  signing: True   SMBv1: False
```

Hosts listed in `targets.txt` are the viable SMB relay targets. DCs always enforce signing and will never appear in this list. Workstations and application servers are the primary targets.

## LDAP signing and channel binding

LDAP relay to a DC allows modifying AD objects as the relayed account. Two protections block this: LDAP signing (prevents relay over plaintext LDAP) and LDAP channel binding / Extended Protection for Authentication (prevents relay over LDAPS). Both must be absent for a relay to LDAP to succeed. The `ldap-checker` module checks both. For the service-level check, see [LDAP Signing and Channel Binding](https://hackindex.io/services/ldap/vulnerability-discovery/ldap-signing-and-channel-binding).

**Check LDAP signing and channel binding**

```bash
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker
# LDAP  10.10.10.10  389  DC01  LDAP Signing NOT Enforced
# LDAP  10.10.10.10  389  DC01  Channel Binding: None
# LDAP  10.10.10.10  389  DC01  Signing and Binding: Vulnerable to LDAP relay
```

If LDAP signing is enforced but channel binding is absent, relay to LDAPS (`ldaps://`) still works. ntlmrelayx handles this automatically when targeting `ldaps://`. If both are enforced, LDAP relay is blocked entirely: fall back to SMB or ADCS relay.

## WebDAV: relay over HTTP

When the WebClient service is running on a Windows host, that host will attempt WebDAV connections over HTTP before falling back to SMB. This means you can coerce HTTP-based NTLM authentication from that host even when SMB signing is enforced: because the relay goes over HTTP, not SMB. The arriving authentication can be relayed to LDAP or ADCS.

WebClient runs on workstations by default in some environments and can be started remotely if the host is reachable. Check whether it is already running before attempting to enable it.

**Check for WebClient service**

```bash
# Check if WebClient is running on target
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M webdav

# Sweep subnet
nxc smb 192.168.1.0/24 -u $USER -p $PASSWORD -M webdav
# SMB  10.10.10.20  445  WS01  WebClient is running
# SMB  10.10.10.30  445  WS02  WebClient is NOT running
```

## Relay target summary

Use the findings from each check to decide what your relay setup targets. SMB signing absent on workstations means ntlmrelayx can relay to those hosts for command execution. LDAP signing unenforced means you can relay to the DC for object modification. WebDAV running means coercion over HTTP works regardless of SMB signing state.

For the relay setup and attack execution see [NTLM Relay in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay).

## References

- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - --gen-relay-list, ldap-checker, webdav module reference