ntlm-relay-coercion
Master NTLM relay attacks to capture and forward authentication across multiple protocols for privilege escalation. Learn relay targets, signing requirements, Responder poisoning, ntlmrelayx execution, mitm6 DNS takeover, and cross-protocol techniques including WebDAV coercion to bypass defenses.
NTLM Relay and Authentication Coercion executes relay attacks across SMB, LDAP, HTTP, and MSSQL to escalate privileges.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
NTLM Relay and Authentication Coercion executes relay attacks across SMB, LDAP, HTTP, and MSSQL to escalate privileges. Master NTLM relay attacks to capture and forward authentication across multiple protocols for privilege escalation. Learn relay targets, signing requirements, Responder poisoning, ntlmrelayx execution, mitm6 DNS takeover, and cross-protocol techniques including WebDAV coercion to bypass defenses.
Use it when
- ntlm-relay-coercion covers relaying NTLM by intercepting authentication and forwarding it to target services.
- ntlm-relay-coercion explains PetitPotam and PrinterBug as primary coercion techniques.
Verify before relying
Read SKILL.md below before installing (2 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/ntlm-relay-coercion · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is ntlm-relay-coercion and how does it enable privilege escalation?
ntlm-relay-coercion teaches NTLM relay attacks—capturing and forwarding authentication tokens across protocols (SMB, LDAP, HTTP, MSSQL) to escalate privileges. The skill covers relay targets, signing bypass techniques, coercion methods like PetitPotam and PrinterBug, and tools like Responder and ntlmrelayx to execute cross-protocol relay chains for domain compromise.
How do you relay NTLM authentication and what are the signing requirements?
ntlm-relay-coercion covers relaying NTLM by intercepting authentication and forwarding it to target services. Success depends on bypassing SMB signing and EPA/channel binding protections. The skill teaches which protocols enforce signing, how to identify vulnerable configurations, and techniques to relay tokens when signing is disabled or misconfigured.
What coercion methods trigger NTLM authentication in ntlm-relay-coercion?
ntlm-relay-coercion explains PetitPotam and PrinterBug as primary coercion techniques. PetitPotam exploits the MS-EFSRPC protocol to force authentication from domain controllers or servers. PrinterBug abuses the Print Spooler service. Both methods force targets to initiate NTLM authentication toward attacker-controlled systems, enabling relay capture.
How does ntlm-relay-coercion set up cross-protocol relay chains like SMB to LDAP?
ntlm-relay-coercion teaches chaining relays across protocols—for example, capturing SMB authentication and relaying it to LDAP or WebDAV services. The skill covers protocol-specific relay targets, service account privileges, and how to chain multiple relays (SMB→LDAP, WebDAV→LDAP) to escalate from initial compromise to domain controller access.
What role do Responder and mitm6 play in ntlm-relay-coercion attacks?
ntlm-relay-coercion covers Responder for LLMNR/mDNS poisoning and passive credential capture, and mitm6 for IPv6 DNS takeover. Both tools intercept authentication traffic and feed it to ntlmrelayx for relay execution. The skill teaches configuring these tools together for combined passive/active capture and relay workflows to compromise Active Directory environments.
Can ntlm-relay-coercion relay NTLM to add computer accounts or enroll certificates?
ntlm-relay-coercion covers advanced relay targets including ADCS certificate enrollment and computer account creation. The skill teaches relaying to domain controllers for account manipulation, using RBCD (Resource-Based Constrained Delegation) and shadow credentials, and leveraging WebClient/WebDAV coercion to reach services that enable privilege escalation beyond initial relay.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: NTLM Relay and Authentication Coercion — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert NTLM relay and coercion techniques. Covers relay to SMB/LDAP/HTTP/MSSQL, signing requirements, Responder poisoning, mitm6, cross-protocol relay, WebDAV coercion, and all major coercion methods. Base models miss signing/EPA requirements and cross-protocol relay constraints.
0. RELATED ROUTING
Before going deep, consider loading:
- active-directory-certificate-services for ESC8 (relay to ADCS enrollment)
- active-directory-acl-abuse for ACL modification via LDAP relay (RBCD, shadow creds)
- active-directory-kerberos-attacks for Kerberos attacks after relay success
- windows-lateral-movement for post-relay
(truncated - see the full file via the links below)
File tree — 2 files
skills/ntlm-relay-coercion/COERCION_METHODS.md
skills/ntlm-relay-coercion/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Execute NTLM relay attacks to escalate privileges via SMB, LDAP, HTTP, or MSSQL”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Auth Coercion Relay guides penetration testers through forcing authentication from remote systems via coercion techniques like PetitPotam and PrinterBug, then relaying those credentials through NTLM or Kerberos to escalate privileges or move laterally. It covers relay targets (SMB, LDAP, AD CS), feasibility checks, and both credential capture and exploitation paths.
Network Attack covers layer-2 and layer-3 poisoning (LLMNR, ARP, DHCPv6), NTLM relay with coercion, traffic interception, and network-service exploitation for lateral movement. It includes TUN-based pivoting with tools like Ligolo-ng and Chisel, plus wireless assessment for WPA2/WPA3. Hand off AD-specific relay work and Kerberos attacks to the active-directory-attack skill.
Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
Network Protocol Attacks provides hands-on techniques for exploiting layer 2 and layer 3 protocols to establish man-in-the-middle positions and capture credentials. Covers ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion with practical tool workflows and relay chaining.
This skill covers offensive techniques for compromising Active Directory environments, including reconnaissance with BloodHound, credential extraction via Kerberoasting and AS-REP roasting, ticket forgery, and lateral movement. Learn pass-the-hash, DCSync, NTLM relay, and exploitation of AD Certificate Services vulnerabilities alongside critical CVE tactics.
This skill covers systematic approaches to elevate from low-privilege shells to root or administrator access on compromised systems. It addresses both local escalation paths—such as exploiting misconfigured sudo, capabilities, and scheduled tasks on Linux—and Windows-specific vectors including token impersonation and service abuse. For domain environments, it includes Active Directory attacks like Kerberoasting, golden tickets, and credential harvesting via LLMNR poisoning.