Overview
Our team completed a focused two-day workshop on NTLM relay attacks; a classic yet still-relevant technique in network security. Despite its age, NTLM remains widely deployed across enterprise environments, making it essential for defenders and red teamers alike to understand how relay attacks work and how to mitigate them.
Workshop Highlights
During the sessions, our team explored NTLM authentication flows and how attackers can exploit weak configurations to relay credentials between systems. The hands-on labs guided participants through real-world attack scenarios, from capturing authentication requests to executing relays for lateral movement.
Our instructor emphasized not only the offensive techniques but also the defensive perspective; including network segmentation, SMB signing, and enforcing Kerberos authentication as mitigation strategies. The HTB Academy lab environment allowed each participant to practice, break things, and learn through trial and error, a key part of mastering the following complex topics:
- Attack surface & theory reviewed. We started by mapping where NTLM is used (SMB, HTTP, LDAP/AD) and the differences between NTLMv1/v2 and Kerberos; this framed why relays work and when they fail (e.g., SMB signing, constrained delegation).
- Poisoning & capture labs. Labs demonstrated name resolution poisoning (LLMNR/NBNS) and WPAD/ICMP techniques to coerce hosts into authenticating to our attacker VM. Tools used: Responder for LLMNR/NBNS/WPAD poisoning and mitm6 for IPv6/DNS poisoning. Participants captured NTLM challenge/response pairs and observed how clients attempted authentication.
- Relaying to service targets. We executed relays against SMB and HTTP endpoints using ntlmrelayx and Impacket scripts. Labs showed relaying captured credentials to:
- Windows SMB to gain file shares or execute psexec-style actions.
- LDAP/AD to perform LDAP queries or, in lab scenarios, add objects when conditions allowed.
- HTTP/REST endpoints to authenticate to web management consoles.
- Defensive lens & remediation techniques. For each offensive step the instructor walked through concrete mitigations: enable SMB signing, enforce Kerberos only, disable NTLM where possible, apply network segmentation, and monitor for anomalous authentication patterns.
- Instructor insights. Emphasis was placed on thinking in scenarios: attackers chain small misconfigurations into large gains. Practical advice included prioritizing quick wins (SMB signing + LLMNR/WPAD hardening) and using purple-team exercises to validate mitigations.
Key Takeaways
- NTLM relay remains an effective technique when protocol safeguards (SMB signing, Kerberos) are not enforced; check and enforce these settings broadly.
- Name resolution poisoning (LLMNR/WPAD/LLMNRv6) is a common initial vector. Disabling or monitoring these protocols gives a high return.
- Practical toolset: Responder, mitm6, ntlmrelayx / Impacket are useful for reproducing attacks in controlled labs; use them in purple-team tests to validate controls.
- Defensive controls are straightforward and high impact: enable SMB signing, prefer Kerberos, harden DNS/WinRM/HTTP endpoints, and apply least privilege + network segmentation.
- Hands-on exercises accelerated team ability to both attack and defend.
Instructors
 |
Marios Pappas
|
