srl
NTLM Relay
How NTLM Relay Works NTLM authentication is challenge-response: the server sends a challenge, the client answers with a hash of the challenge using its password hash. An attacker who can position themselves between client and server can forward the challenge/response to a different service and authenticate as the victim — without cracking anything.
The attack has two halves:
Coerce or poison a victim into authenticating to you (LLMNR/NBT-NS/mDNS poisoning, or a coercion RPC call). Relay that authentication to a target service where the victim’s account has rights. Relay succeeds only when the target does not require signing or channel binding. Check this before spending time: SMB signing must be not required, LDAP signing and LDAP channel binding must be off, and for HTTPS enrollment the CA Web Enrollment endpoint must accept NTLM. But — 2025–2026 research changed this assumption. Drop the MIC and CVE-2025-54918 strip the protections that were supposed to block relay even when signing is enforced.