ntlm-relay-coercion
Master NTLM relay attacks to capture and forward authentication across multiple protocols for privilege escalation. Learn relay targets, signing requirements, Responder poisoning, ntlmrelayx execution, mitm6 DNS takeover, and cross-protocol techniques including WebDAV coercion to bypass defenses.
NTLM Relay and Authentication Coercion executes relay attacks across SMB, LDAP, HTTP, and MSSQL to escalate privileges.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/ntlm-relay-coercion · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/ntlm-relay-coercion ~/.claude/skills/ntlm-relay-coercionnpx skillfed install yaklang/hack-skills/ntlm-relay-coercionFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is ntlm-relay-coercion and how does it enable privilege escalation?
ntlm-relay-coercion teaches NTLM relay attacks—capturing and forwarding authentication tokens across protocols (SMB, LDAP, HTTP, MSSQL) to escalate privileges. The skill covers relay targets, signing bypass techniques, coercion methods like PetitPotam and PrinterBug, and tools like Responder and ntlmrelayx to execute cross-protocol relay chains for domain compromise.
How do you relay NTLM authentication and what are the signing requirements?
ntlm-relay-coercion covers relaying NTLM by intercepting authentication and forwarding it to target services. Success depends on bypassing SMB signing and EPA/channel binding protections. The skill teaches which protocols enforce signing, how to identify vulnerable configurations, and techniques to relay tokens when signing is disabled or misconfigured.
What coercion methods trigger NTLM authentication in ntlm-relay-coercion?
ntlm-relay-coercion explains PetitPotam and PrinterBug as primary coercion techniques. PetitPotam exploits the MS-EFSRPC protocol to force authentication from domain controllers or servers. PrinterBug abuses the Print Spooler service. Both methods force targets to initiate NTLM authentication toward attacker-controlled systems, enabling relay capture.
How does ntlm-relay-coercion set up cross-protocol relay chains like SMB to LDAP?
ntlm-relay-coercion teaches chaining relays across protocols—for example, capturing SMB authentication and relaying it to LDAP or WebDAV services. The skill covers protocol-specific relay targets, service account privileges, and how to chain multiple relays (SMB→LDAP, WebDAV→LDAP) to escalate from initial compromise to domain controller access.
What role do Responder and mitm6 play in ntlm-relay-coercion attacks?
ntlm-relay-coercion covers Responder for LLMNR/mDNS poisoning and passive credential capture, and mitm6 for IPv6 DNS takeover. Both tools intercept authentication traffic and feed it to ntlmrelayx for relay execution. The skill teaches configuring these tools together for combined passive/active capture and relay workflows to compromise Active Directory environments.
Can ntlm-relay-coercion relay NTLM to add computer accounts or enroll certificates?
ntlm-relay-coercion covers advanced relay targets including ADCS certificate enrollment and computer account creation. The skill teaches relaying to domain controllers for account manipulation, using RBCD (Resource-Based Constrained Delegation) and shadow credentials, and leveraging WebClient/WebDAV coercion to reach services that enable privilege escalation beyond initial relay.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: NTLM Relay and Authentication Coercion — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert NTLM relay and coercion techniques. Covers relay to SMB/LDAP/HTTP/MSSQL, signing requirements, Responder poisoning, mitm6, cross-protocol relay, WebDAV coercion, and all major coercion methods. Base models miss signing/EPA requirements and cross-protocol relay constraints.
0. RELATED ROUTING
Before going deep, consider loading:
- active-directory-certificate-services for ESC8 (relay to ADCS enrollment)
- active-directory-acl-abuse for ACL modification via LDAP relay (RBCD, shadow creds)
- active-directory-kerberos-attacks for Kerberos attacks after relay success
- windows-lateral-movement for post-relay
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/ntlm-relay-coercion/COERCION_METHODS.md
skills/ntlm-relay-coercion/SKILL.md