Detecting NTLM Relay Attacks

https://posts.bluraven.io/detecting-ntlm-relay-attacks-d92e99e68fb9

#detection #ntlm #relay #blueteam

NTLM Relaying — A comprehensive guide

This guide covers a range of techniques from most common to the lesser-known.

https://www.trustedsec.com/blog/a-comprehensive-guide-on-relaying-anno-2022/

#ad #ntlm #relay #guide

Password Spraying and MFA Bypasses

https://www.sprocketsecurity.com/blog/how-to-bypass-mfa-all-day

#ntlm #password #spraying #o365 #exchange #mfa

Keeping Up with the NTLM Relay

https://www.fortalicesolutions.com/posts/keeping-up-with-the-ntlm-relay

#ad #ntlm #relay #adcs

Coercing NTLM Authentication from SCCM

https://posts.specterops.io/coercing-ntlm-authentication-from-sccm-e6e23ea8260a

#ad #ntlm #sccm

NTLM Relay

This article is not meant to be a tutorial to be followed in order to carry out a successful attack, but it will allow the reader to understand in detail the technical details of this attack, its limitations, and can be a basis to start developing his own tools, or understand how current tools work.

https://en.hackndo.com/ntlm-relay/

#ad #relay #ntlm #ntlmrelay

NTLMRelay2Self over HTTP

Just a walkthrough of how to escalate privileges locally by forcing the system you landed initial access on to reflectively authenticate over HTTP to itself and forward the received connection to an HTTP listener (ntlmrelayx) configured to relay to DC servers over LDAP/LDAPs for either setting shadow credentials or configuring RBCD.

https://github.com/med0x2e/NTLMRelay2Self

#ad #ntlm #relay #rbcd #redteam

📡 Relaying to ADFS Attacks

Praetorian has developed and is releasing an open source tool ADFSRelay and NTLMParse, which can be used for performing relaying attacks targeting ADFS and analyzing NTLM messages respectively.

https://www.praetorian.com/blog/relaying-to-adfs-attacks/

#ad #adfs #relay #ntlm

#ad #rpc #ntlm #privesc

[ Coercer ]

atricle: https://github.com/p0dalirius/windows-coerced-authentication-methods
There is currently 15 known methods in 5 protocols.

tool: https://github.com/p0dalirius/Coercer
A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.

⚙️ Determining AD domain name via NTLM Auth

If you have nmap (http-ntlm-info) unable to determine the FQND of an Active Directory domain via OWA, for example due to Citrix NetScaler or other SSO solutions, do it manually!

1) curl -Isk -X POST -H 'Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKANc6AAAADw==' -H 'Content-Length: 0' https://autodiscover.exmaple.com/ews

2) echo 'TlRMTVNTUAACAAAADAAMAD...' | python2 ./ntlmdecoder.py

One-Liner function for bashrc\zshrc\etc-rc:

ntlm_decode() { curl -Isk -X POST -H 'Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKANc6AAAADw==' -H 'Content-Length: 0' "$1" | awk -F 'NTLM ' '/WWW-Authenticate: NTLM/ {print $2}' | python2 "$(locate ntlmdecoder.py)"; }

Source:
ntlmdecoder.py

#ntlm #auth #sso #tricks #pentest

📡 NTLMv1 vs NTLMv2: Digging into an NTLM Downgrade Attack

This article discusses the NTLM specifications to better understand how various aspects of the NTLM protocol function. As well as bypassing the SMB signature, relaying SMB to LDAP, and relaying NTLMv1 authentication attempts to the ADFS service.

https://www.praetorian.com/blog/ntlmv1-vs-ntlmv2/

#ad #ntlm #smb #relay

🔑 Pass-the-Challenge

This blog post introduces new techniques for recovering the NTLM hash from an encrypted credential protected by Windows Defender Credential Guard. While previous techniques for bypassing Credential Guard focus on attackers targeting new victims who log into a compromised server, these new techniques can also be applied to victims logged on before the server was compromised.

Research:
https://research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22

Source:
https://github.com/ly4k/PassTheChallenge

#ad #windows #ntlm #challenge

🔄 Active Directory GPOs through NTLM relaying, and more!

Learn about a attack vector that exploits GPOs through NTLM relaying, potentially allowing unauthenticated attackers to abuse.

🌐 Source:
https://www.synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more

#ad #gpo #relay #ntlm