NTLM Relay and Authentication Coercion

Overview

NTLM relay forwards NTLM authentication received from a client to another service, where it authenticates with the client’s rights. It relays an ongoing challenge-response exchange rather than directly stealing a password or NT hash.

The surrounding terms are easier to understand separately.

Term	Role
Responder	A listener that responds to LLMNR, NBT-NS, mDNS, WPAD, SMB, HTTP, and similar traffic to capture a NetNTLMv2 response.
Coercer	A tool that uses an RPC interface or similar mechanism to cause a target host to authenticate outbound to the attacker.
ntlmrelayx	A tool that receives NTLM over SMB or HTTP and relays it to another service, such as LDAP, LDAPS, SMB, or HTTP.

Responder and Name Resolution Fallback

If Windows cannot resolve a name through DNS, its configuration may allow fallbacks such as LLMNR, NBT-NS, mDNS, or WPAD. Responder replies to these queries as though it owns the requested name, causing the target to connect over SMB or HTTP.

Windows host -> DNS name resolution fails
Windows host -> Queries nearby hosts through LLMNR/NBT-NS
Responder    -> Replies that it owns the requested name
Windows host -> Connects over SMB/HTTP
Responder    -> Captures the NetNTLMv2 response

For Responder to work, the target must be able to connect back to the listener. LLMNR and NBT-NS are more likely to work within one broadcast segment. On a routed network or through a pivot, choose a listening address that the target can reach.

Authentication Coercion

Coerced authentication makes a target host process a UNC path, such as \\listener\share\file.txt, and authenticate outbound as its own machine account, such as WEB01$, using NTLM.

Common families include PetitPotam, PrinterBug, and DFSCoerce. They share the basic pattern of making a target open a path on the attacker side.

attacker -> Calls an RPC endpoint
target   -> Tries to access \\listener\share
target   -> Authenticates to the listener with NTLM as its machine account
relay    -> Forwards the received NTLM to another service

Even if a coercion tool shows ERROR_BAD_NETPATH or NO_AUTH_RECEIVED, another method may have triggered authentication. Judge success by whether the intended account reached the listener or authenticated at the relay destination.

Where ntlmrelayx Relays Authentication

ntlmrelayx listens as an SMB or HTTP server on the attacker side and forwards received NTLM authentication to another target service.

machine account --SMB NTLM--> attacker:445 / ntlmrelayx
ntlmrelayx      --relay-----> ldaps://dc.example.local
LDAP modify     --effect----> Change an AD object attribute

What the relay can do depends on the forwarded account’s rights on the destination service. For example, given the right conditions, LDAP or LDAPS relay can modify an AD object attribute such as the RBCD (Resource-based Constrained Delegation) setting of a computer object.

Choosing a Listening Address

A listener option such as coercer -l names the address to which the target connects back. Specify an IP address the target can reach on the attacker side, not merely an IP address from which the attacker can reach the target.

Checks:

Are you still using an old tunnel IP after reconnecting to the VPN?
Is the listener using an interface IP visible from the pivot destination?
Are ports 445, 80, or 8080 blocked by a firewall or an existing service?
For HTTP or WebDAV relay, do the target’s WebClient service and proxy or firewall permit communication?
For SMB relay, does the relay destination require SMB signing?

Defensive Priorities

Disable unnecessary name resolution fallbacks such as LLMNR, NBT-NS, and WPAD.
Enable SMB signing, LDAP signing, LDAP channel binding, and Extended Protection for Authentication (EPA).
Restrict unnecessary RPC interfaces and services commonly used for coercion, such as Print Spooler.
Review machine account rights, RBCD, and delegation settings.
Audit NTLM authentication use and move toward configurations that prefer Kerberos.