Relay Attacks and NTLM Authentication Practice

Vocabulary and key concepts regarding NTLM relay attacks, authentication coercion methods, and SMB signing defenses.

Relay attacks

A technique used to redirect authentication from one source to another, tricking a system like Device A into authenticating to an attacker-owned machine so the authentication can be relayed to a target like Device B.

PetitPotam

A novel means of forcing a client to authenticate by taking advantage of Microsoft Encryption File System Remote Protocol (MS-EFSRPC) to convince a victim to authenticate over MS-LSARPC on port $445$.

DFSCoerce

A newer exploitation released in $2022$ by Wh04m1001 that uses Microsoft Distributed File System Namespace Management (MS-DFSNM) to force a DC to authenticate against an NTLM relay.

MS-EFSRPC

Microsoft Encryption File System Remote Protocol.

MS-LSARPC

Microsoft Local Security Authority Remote Procedure Call.

MS-DFSNM

Microsoft Distributed File System Namespace Management.

SMB signing

A security mechanism that ensures the integrity and authenticity of SMB traffic by signing each message using a session key derived during NTLM or Kerberos authentication.

Session key

A shared key derived between the client and server during authentication to sign SMB messages; it is created when the user authenticates to a specific server rather than the entire domain.

LDAP relay

An attack that remains possible in some environments because LDAP signing is often not enforced by default, even if SMB signing is active.

Enabled Policy (SMB Signing)

A group policy setting where the machine will refuse unsigned SMB sessions.

Disabled Policy (SMB Signing)

A group policy setting where the machine will allow unsigned SMB sessions.

Microsoft network client: Digitally sign communications (always)

A policy that forces the system to require SMB message signing for all outgoing SMB connections to prevent NTLM relay and MITM attacks.

SMB Ports

Typically includes ports $135$, $137$, $139$, and $445$ when SMB is enabled.

SweetPotato

A collection of various native Windows privilege escalation techniques used to move from service accounts to SYSTEM, associated with CVE-$2019-1040$.

PrinterBug

An NTLM authentication coercion attack that involves MS-RPRN abuse.

Mitm6

A tool used in conjunction with ntlmrelayx to relay NTLM authentication to LDAP to obtain hashes.