ntlm-relay-coercion

NTLM relay captures and forwards authentication traffic to escalate privileges in penetration testing. By intercepting NTLM authentication requests, the technique relays credentials to SMB, LDAP, HTTP, or MSSQL targets, enabling deeper network access without cracking passwords.

To coerce Windows authentication using PetitPotam or PrinterBug, you exploit specific protocol behaviors to force a host to initiate NTLM authentication. This coerced traffic is then captured and relayed to target services like LDAP or SMB for privilege escalation.

Yes, you can use ntlmrelayx and Responder together for cross-protocol relay attacks. Responder handles the initial network poisoning to capture traffic, while ntlmrelayx manages relaying the captured NTLM authentication to downstream targets like SMB, LDAP, HTTP, or MSSQL.

NTLM relay to SMB fails when SMB signing is required and enforced. However, cross-protocol relay to other targets like LDAP, HTTP, or MSSQL remains viable if those specific services do not enforce their own channel binding or signing requirements.

The best way to start an NTLM relay to an SMB target is to use the ntlm-relay-coercion skill's quick start functionality. This initiates the relay process by configuring the necessary tools to intercept and forward authentication traffic to the designated SMB destination.