Skip to main content
Applies to BloodHound Enterprise and CE This edge indicates that an attacker with “Authenticated Users” access can compromise the target computer by relaying the NTLM authentication of a victim computer with administrative rights on the target computer. The attack is possible because the attacker can trigger SMB-based coercion from the victim computer to their attacker-controlled host, and the target computer does not enforce SMB signing.

​
Abuse Info

This section provides general guidance about abusing this edge. For detailed instructions, see references at the end of this article.

​
Linux

  1. Start the Relay Server The NTLM relay can be executed with ntlmrelayx.py.
  2. Coerce the Target Computer Several coercion methods are documented here: Windows Coerced Authentication Methods. Examples of tools include:

​
Windows

  1. Take Over the SMB Port on the Attacker Host To avoid a conflict with SMB running on the attacker-controlled Windows computer, it is necessary to takeover the SMB port. This can be achieved with smbtakeover.
  2. Start the Relay Server The NTLM relay can be executed with Inveigh.
  3. Coerce the Target Computer Several coercion methods are documented here: Windows Coerced Authentication Methods. Examples of tools include:

​
Opsec Considerations

NTLM relayed authentications can be detected by login events where the IP address does not match the computer’s actual IP address. This detection technique is described in the blog post: Detecting NTLM Relay Attacks.

​
Edge Schema

Source: Authenticated Users, Group
Destination: Computer
Traversable: Yes

​
References