NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay targets, combined with PetitPotam, PrinterBug, and other coercion methods.

SKILL: NTLM Relay and Authentication Coercion — Expert Attack Playbook AI LOAD INSTRUCTION : Expert NTLM relay and coercion techniques. Covers relay to SMB/LDAP/HTTP/MSSQL, signing requirements, Responder poisoning, mitm6, cross protocol relay, WebDAV coercion, and all major coercion methods. Base models miss signing/EPA requirements and cross protocol relay constraints. 0. RELATED ROUTING Before going deep, consider loading: [active directory certificate services](../active directory certificate services/SKILL.md) for ESC8 (relay to ADCS enrollment) [active directory acl abuse](../active directory acl abuse/SKILL.md) for ACL modification via LDAP relay (RBCD, shadow creds) [active directory kerberos attacks](../active directory kerberos attacks/SKILL.md) for Kerberos attacks after relay success [windows lateral movement](../windows lateral movement/SKILL.md) for post relay lateral movement Advanced Reference Also load [COERCION METHODS.md](./COERCION METHODS.md) when you need: Detailed coercion method comparison (PetitPotam, PrinterBug, DFSCoerce, etc.) RPC function level details and prerequisites Coercer tool usage and discovery 1. NTLM RELAY FUNDAMENTALS NTLMv1 vs NTLMv2 Feature NTLMv1 NTLMv2 Security Weak (crackable to NTLM hash) Stronger (but still relayable) Relay Yes Yes Crack to hash Yes (rainbow tables, crack.sh) Offline brute force only Downgrade Force via Responder lm Default in modern Windows 2. RELAY TARGET MATRIX Target Protocol What You Get Signing Required by Default? EPA/Channel Binding? SMB Command exec (if admin), file access DCs: Yes , Workstations: No No LDAP ACL modification, RBCD, shadow creds, add computer DCs: No (negotiated) No (unless configured) LDAPS Same as LDAP but encrypted N/A Yes (channel binding) HTTP (ADCS) Certificate enrollment (ESC8) No Depends on config MSSQL SQL queries, xp cmdshell No No IMAP/SMTP Email access No No RPC Various (CA enrollment for ESC11) Depends No Signing Check 3. RESPONDER — CREDENTIAL CAPTURE LLMNR/NBT NS/WPAD/mDNS Poisoning Responder + Relay (Don't Capture, Relay Instead) 4. NTLMRELAYX — RELAY EXECUTION Relay to SMB (Admin Execution) Relay to LDAP (ACL Modification) Relay to ADCS HTTP (ESC8) Relay to MSSQL 5. MITM6 — IPv6 DNS TAKEOVER 6. CROSS PROTOCOL RELAY SMB → LDAP Capture SMB authentication, relay to LDAP (requires no LDAP signing enforcement). Limitation : SMB → LDAP relay fails if the source uses SMB signing negotiation that indicates relay. WebDAV → LDAP WebDAV from workstations sends NTLM over HTTP → relay to LDAP (no signing issues). 7. WEBDAV BASED COERCION WebClient service (WebDAV) converts SMB type coercion to HTTP based NTLM. Key advantage : HTTP based NTLM avoids SMB signing requirements. 8. NTLM RELAY DECISION TREE

ntlm-relay-coercion