hunting-ntlm-coercion-and-relay

Hunting NTLM coercion and relay: when a forced login lands on the wrong service

Windows authentication was designed to be forwarded: a client proves who it is to a server, and nothing in a challenge-response exchange inherently ties that proof to the service the client meant to reach. An attacker exploits both halves. First coercion: a feature that makes a machine or account connect outbound, an automatic connection to a supplied path, a print or backup trigger, or any function that authenticates to an attacker-named host. Second relay: the captured authentication is forwarded to a different service, and if that service does not require signing or verify channel binding, it accepts the forwarded proof and treats the attacker as the coerced identity. A relayed domain controller or privileged host becomes control of that service. The bug is a service that accepts network authentication without binding it to the channel, reachable by an identity an attacker can coerce. You hunt these by pairing coercion triggers with services that fail to enforce signing or channel binding.

When to use

• Services accept network authentication without mandatory signing or channel binding on a network you assess.
• A privileged machine or account can be induced to authenticate outbound to an attacker-named host.
• A directory, certificate, or file service is reachable by a coercible identity without channel protection.

Scope check

Test coercion and relay only on networks you own or are authorized to assess, on non-production or a lab domain, coercing only hosts you are permitted to and relaying only to services in scope, never acting as a real privileged identity beyond a benign proof. A confirmed relay authenticates as a privileged account, so keep every probe within scope. If you can't name the authorization, stop.

The loop

1. Establish whether the target service enforces signing and channel binding first. For each service that accepts network authentication, determine whether it requires signing and verifies channel binding, so a relayed authentication is rejected, or whether it accepts forwarded proof unbound to the channel. This is the false-positive killer: a service that mandates signing or binds the channel cannot be relayed to, so a coercion trigger alone is not a finding. Name the service's enforcement before pairing it with a trigger.