ghostsurf: From NTLM Relay to Browser Session Hijacking

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR: ntlmrelayx‘s SOCKS proxy works great for SMB and MSSQL but fails when you try to browse a web application through it – I dug into why, found several fundamental issues with how it handles HTTP, built ghostsurf to fix them, and along the way, discovered (and circumvented) some undocumented Windows kernel auth behavior. ghostsurf lets you browse web applications that accept NTLM auth (i.e., enterprise password vaults!) as a relayed user through a SOCKS5 proxy, even when cookie theft is not an option.

Tool: https://github.com/senderend/ghostsurf

Where This Started

On a recent assessment, the target environment used CyberArk Privileged Access Manager. The intended workflow for both users and admins was to browse to an internally hosted web interface where they automatically authenticated via windows logon session and copy-pasted passwords from the browser. We compromised a relay position and captured NTLM authentication for a privileged domain account (not crackable). If we could browse CyberArk as this user, we’d have access to every secret this account was provisioned, and could pivot deeper into the environment with our choice of a vast array of services.

ntlmrelayx from the Impacket suite has a SOCKS proxy feature for scenarios like this. After relaying NTLM authentication, it opens a SOCKS5 proxy that lets you route traffic through the authenticated session. This works well for protocols like SMB and MSSQL, where you can point tools like smbclient or mssqlclient through the proxy and attack the target interactively. But when we configured our browser’s SOCKS …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://specterops.io/blog/2026/04/02/ghostsurf-from-ntlm-relay-to-browser-session-hijacking/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.