NTLM Relaying 101 - How to make your internal pentests pop

NTLM Relaying 101

1. Relaying 101
How to make your internal pentestspop
Jean-Francois Maes

2. Practical Information
•Workbook link: https://jfmaes-1.gitbook.io/ntlm-
relaying-like-a-boss-get-da-before-lunch/setup
•VM downloads –

3. What this workshop is about / Who is this workshop for?
•This workshop is for internal pentests–no red team shenanigans here J
•This workshop does not care about detection –NTLM Relaying is very much
a jackhammer approach, not a surgical one
•The intended audience for this workshop are beginning pentestersor people
interested in learning about these attacks. If you already are comfortable with
relaying attacks, this workshop is likely not for you.

4. Agenda
•Introducing “DA LAB”
•A “classic” internal pentest scenario –Why care about relaying anyway?
•A brief look at NTLM authentication
•Broadcast traffic = best traffic –Why is relaying still successful?
•Respond to all the things!
•All hail RPC (and IPv6)
•Relay options and gotcha’s
•Q&A

5. DA LAB
Quite Simple setup really!
-1 Domain (ntlmrange.local)
-1 DC –Any Windows Server OS
-1 “FileServer” –Any Windows Server OS
-1 “victim” –Any Windows OS
-1 Attacker Controlled Machine
(any Linux distro u want)

6. Configuration
JUST KIDDING
Since Relaying doesn’t play well in the cloud,
we are going to use our local computer to run
the lab. VMs can be downloaded but can be
setup yourself as well, it is in the workbook. J

7. DA LAB
•Some setup required!
•MAKE SURE your VMS are in the same subnet and can ping eachother
•MAKE SURE your DCcan still reach the internet, use nator bridged and set the DNS server to primary
DNS DC and fallback DNS a well-known DNS provider like 8.8.8.8 or 1.1.1.1
•When joining the other VMs to the domain DO NOT use a secondary DNS, only set DNS to the DC IP

8. A “classic” internal pentest scenario
“You have been tasked to assess the internal security posture of Tegridy Farms.
In order to perform this assessment, Tegridy Farms has granted you permission
to come test on site as if you were a malicious insider or allows you to place an
attacker-controlled device in the network with secure remote access.”
WHAT DO YOU DO?

9. Thought process –What is the first step in both?

10. Reconnaissance
•AD Objects…
•LDAP interaction required!
•If you are lucky, you can null bind (anonymous read access)
•Usually disabled though, so no creds, no recon!
•Can sometimes be “bypassed” if they are using predictable naming conventions or
very short usernames like AA0000

11. Reconnaissance
So, if no null bind and no creds… AD
objects are out of the window...
Is there Anything else we can do?

12. NTLM Authentication
Domain
Controller
1. Requestauthentication
Service
Database Server
2. Challenge
3. Response
Client
Workstation
6. Authenticatedgranted/ denied
Theauthenticatingsystemusesthehashed
credentialtocalculatearesponsebasedon
thechallengesentbytheserver
Whentheadversaryobtainsachallenge/
response,offlinebruteforceattackscanbe
launchedtoidentifythehashedcredential
thatwasusedtogeneratetheresponse
4. Forward Chal+ Resp
5.Validation

13. NTLM relaying in a nutshell

14. SMB

15. Broadcast Traffic = Best Traffic
•Most broadcast traffic are legacy DNS fallback protocols like LLMNR and NBT-NS
•If DNS doesn’t work, system sends broadcast message to ask if anyone knows who xxx is
•All we got to do is reply that we are xxx, and get that sweet authentication request

16. Respond to all the things!

17. All hail RPC! (and IPv6)
•What if there is no broadcast traffic? Are we stuck?
•Nope JSeveral RPC calls can coerce authentication some have specific requirements though such
as a specific service that needs to be running example printspooler
•If the environment is not using IPv6 but systems are configured (default) for IPv6 Solicitation, we can
poison that also.

18. Relay Options and gotcha’s

19. Relay Options and gotcha’s
Option 0: Just listen

20. Relay Options and gotcha’s
Option 1: Taking a dump

21. Relay Options and gotcha’s
Option 2: Are you wearing socks?

22. Relay Options and gotcha’s
Option 3: Authenticated recon baby!

23. Relay Options and gotcha’s
Option 4: RBCD

24. Relay Options and gotcha’s
Option 5: Shadow credentials

25. A “classic” internal pentest scenario
“You have been tasked to assess the internal security posture of Tegridy Farms.
In order to perform this assessment, Tegridy Farms has granted you permission
to come test on site as if you were a malicious insider or allows you to place an
attacker-controlled device in the network with secure remote access.”
WHAT DO YOU DO?

26. A “classic” internal pentest scenario
RELAY ALL THE THINGS!
+

27. Q&A

28. SHOUTOUTS
•Hack n Do
•Bytebleeder
•Hacker Recipes
•Specterops
•Dirkjan( and fox-it )
•MdSec
•James ForShaw
•Klezvirus
•pythonresponder
•All contributors to impacketand responder
•And many manymore…