There and Back Again: An Operators Guide on NTLM Relaying Egress

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR – What’s old is new again. Remember coercing SMB NTLM egress tradecraft to crack challenge response back in the day? We see a lot of situations in our assessments where relaying NTLM from coerced network egress is ideal when escalating locally over C2 is unattainable or firewall rules are in play preventing WebDav relays to LDAP. This technique involves NTLM authentication coercion outbound to the internet, catching that traffic with a cloud host, and forwarding that traffic back to our red team infrastructure where it will be proxied back into the target environment to a service which will allow identity or computer takeover. 

Acknowledgements and Prior Work

Before getting into the operator guidance and tradecraft, as always there’s a collection of previous work and acknowledgements that this blog is built off of. I am not the original creator of this technique (and coercing NTLM authentication to the internet is not new), but turning that authentication coercion into an NTLM relay isn’t commonly covered. This blog mostly serves as a public resource to share this (maybe) long forgotten tradecraft in a modernized format that we still use during our operations quite commonly. 

Nick Power’s NTLM relay guidance for operationalizing relay tradecraft over command and control (C2) without loading a driver in his SMBTakeover blog

Elad Shamir’s deep dive into NTLM relay tradecraft from a research perspective which describes a large amount of context for the attack techniques presented in this blog, found here

Matt Creel’s NTLM relaying over SOCKS guidance in this …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://specterops.io/blog/2026/07/15/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.