NTLM RELAY

PRIMARY CATEGORY → NTLM

Theory

Zoom In

---

Reflective NTLM Relay (Self-Relay)

Patched

MS08-068

---

Mitigations & Protections

• 
  • SESSION SIGNING
• 
  • MIC
• 
  • EPA

---

Relaying NTLM

• 
  • NTLM RELAY OVER SMB
• 
  • NTLM RELAY OVER HTTP

---

Resources

Elad Shamir - Reflective NTLM Relay is Dead

Temp Resources

https://gist.github.com/zimnyaa/dcac97f3106e96053a1acb6ca9974e55
https://www.nccgroup.com/research-blog/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation/
https://www.blackhillsinfosec.com/wp-content/uploads/2022/10/SLIDES_CoercionsandRelays-TheFirstCredistheDeepest.pdf

---