Relaying the hash

In the previous chapter, we covered different possibilities to capture the NTLM response by forcing authentication or using MitM. Now we are getting to the answer of why we want to capture responses. Before we jump into practice, some theory concepts and caveats need to be explained first.

First, there are two versions of the NTLM protocol (v1 and v2). Next, NTLM authentication messages can be relayed cross-protocol as they are protocol-independent. It is important to understand what protocol was used to capture NTLM authentication and what protocol we are planning to relay it over. The following mindmap was created by nwodtuhs and is a good reference for our discussion.

Figure 5.6 – NTLM relay

Let us focus more on an important topic, which is signing, especially for SMB and LDAP. Signing configuration and existence is controlled by settings on the client and server side. For SMB, it will depend on the protocol version and whether...