ntlmrelayx Explained: Mechanics, Attacks, and Defenses

 ntlmrelayx

ntlmrelayx is a well-known tool from the Impacket suite used in cybersecurity, primarily for penetration testing and red-team exercises. It exploits weaknesses in Microsoft’s NTLM (NT LAN Manager) authentication protocol to perform what’s called an NTLM relay attack.

1. Background: NTLM Authentication

Before understanding ntlmrelayx, you need to know how NTLM works.

NTLM basics

NTLM is a challenge-response authentication protocol used in Windows environments when Kerberos isn’t available.

Simplified flow:

1. Client requests authentication to a server

2. Server sends a challenge (random value)

3. Client encrypts the challenge using its password hash → sends response

4. Server verifies response

Important property:

• The password is never sent directly, but the response can still be reused in certain contexts.

2. What Is an NTLM Relay Attack?

An NTLM relay attack takes advantage of:

• NTLM’s lack of binding between authentication and the target service
• The ability to reuse authentication messages across services

Concept:

An attacker:

1. Tricks a victim into authenticating to them

2. Intercepts the NTLM authentication

3. Relays it to another service/server

4. Gains access as the victim

Key point:

The attacker does NOT crack the password; they just reuse the authentication.

3. What ntlmrelayx does

ntlmrelayx is a tool that:

• Receives incoming NTLM authentication
• Relays it to another target system or service
• Optionally performs post-authentication actions

It essentially automates NTLM relay attacks.

4. High-Level Architecture

ntlmrelayx acts as a multi-protocol relay server.

Components:

• Listener(s):
• SMB
• HTTP/HTTPS
• LDAP
• MSSQL
• Relay engine
• Targets list
• Attack modules (post-auth actions)

Logical flow:

• Victim → ntlmrelayx (attacker) → Target server

5. Step-by-Step Conceptual Flow

Step 1: Trigger authentication

The attacker causes a victim machine to authenticate via:

• SMB (file share)
• HTTP (web request)
• Other protocols

Step 2: Capture NTLM handshake

The victim sends:

• Username
• NTLM challenge/response

Step 3: Relay to the target

ntlmrelayx forwards the authentication to a target system:

• File server (SMB)
• Active Directory (LDAP)
• Web app (HTTP)
• SQL server

Step 4: Target accepts authentication

If protections are not enabled:

• The target believes it’s talking directly to the victim
• Grants access

Step 5: Perform actions

Depending on the configuration, ntlmrelayx can:

• Dump data
• Execute commands (if privileges allow)
• Modify LDAP objects
• Add users or privileges

6. Supported Protocols

ntlmrelayx is powerful because it supports many protocols:

Input (incoming authentication):

• SMB
• HTTP/HTTPS

Relay targets:

• SMB
• LDAP / LDAPS
• HTTP / HTTPS
• MSSQL
• IMAP / SMTP (limited cases)

7. Common Use Cases (High-Level)

In authorized testing environments, it is used to:

1. Lateral movement

• Reuse one machine’s authentication to access another system

2. Privilege escalation

• Relay a domain admin’s authentication to LDAP to modify AD

3. Active Directory attacks

• Abuse LDAP to:
• Add computer accounts
• Modify delegation settings
• Change permissions

4. Data access

• Access SMB shares without credentials

8. Why NTLM Relay Works

The vulnerability exists because:

NTLM lacks:

• Mutual authentication (client verifies server, but not vice versa)
• Channel binding (authentication isn’t tied to a specific connection)
• Integrity protection across services

9. Defenses against NTLM Relay

Modern environments can mitigate these attacks with:

Protocol-level protections

• SMB signing
• LDAP signing and channel binding
• Kerberos instead of NTLM

Network protections

• Disable NTLM where possible
• Restrict outbound authentication
• Use firewalls to block unnecessary protocols

Identity protections

• Privileged Access Management
• Least privilege

10. Important Security Note

ntlmrelayx is a legitimate security tool, but:

• It is also used in real-world attacks
• It should only be used in authorized environments (labs, pentests, training)

11. Relationship to Other Techniques

ntlmrelayx is often used alongside:

• Responder → captures and triggers NTLM authentication
• MitM6 → forces IPv6 NTLM authentication
• PetitPotam / PrinterBug → coerces authentication
• Impacket tools in the general ecosystem

12. Key Takeaways

• ntlmrelayx does not crack passwords; it reuses authentication
• It exploits weaknesses in the NTLM protocol design
• It enables powerful lateral movement and AD attacks
• Modern defenses can largely mitigate it if properly configured