Walkthrough Demonstrates How NTLM Reflection and Delegation Misconfigurations Can Compromise Active Directory
Summary
A lab walkthrough chains NTLM reflection/relay, disabled SMB signing, unconstrained delegation and Kerberos ticket abuse to escalate from low-privileged domain access to DCSync and Active Directory domain control, then outlines mitigations.
Key points
- The lab starts with low-privileged domain credentials and identifies a workstation with unconstrained delegation enabled and SMB signing disabled.
- DNS redirection and authentication coercion direct NTLM authentication to a relay; reflection against the workstation enables local SAM hash extraction.
- The walkthrough uses the compromised delegated host to capture a Domain Controller Kerberos TGT after coercing the controller to authenticate.
- Reusing the captured TGT enables DCSync and domain credential-hash extraction; the article presents this as full domain compromise in the lab.
- Recommended defenses include enforcing SMB signing, disabling unconstrained delegation, restricting NTLM, disabling unnecessary services and monitoring Kerberos and DCSync activity.
Article Details
- Topic
- Unconstrained delegation and NTLM reflection/relay abuse to compromise Active Directory domains
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]168[.]188[.]131 | Attacker-system IP used for the malicious DNS redirection and to host post-exploitation tools and payloads. |
| URL | hxxp[:]//192[.]168[.]188[.]131/Rubeus.exe | Attacker-hosted URL used to deliver Rubeus to the compromised target for Kerberos ticket operations. |
MITRE ATT&CK
T1003 · OS Credential DumpingCredential dumping was performed, including extracting local SAM hashes and domain credential hashes.T1021 · Remote ServicesThe article maps lateral movement across the domain after credential and ticket abuse.T1557 · Adversary-in-the-MiddleThe article identifies NTLM relay as part of the attack, relaying coerced authentication to compromise a host.T1558 · Steal or Forge Kerberos TicketsCaptured Kerberos tickets, including a Domain Controller TGT, were reused for privilege escalation.
Products
Tools
DNStoolInstall the DNS manipulation tool using DNStool from the krbrelayx repository.Evil-WinRMAttacker Machine: Kali Linux — NXC, Rubeus, Evil-WinRM, krbrelayx, Impacket, DNS manipulation toolImpacketTicket Abuse and Domain Compromise — The captured TGT was injected and used to perform a DCSync attack via Impacket, achieving full domain compromise.KrbRelayxAttacker Machine: Kali Linux — NXC, Rubeus, Evil-WinRM, krbrelayx, Impacket, DNS manipulation toolntlmrelayxNTLM Relay Setup and Authentication Coercion — An NTLM relay listener was initiated using ntlmrelayx, and the target machine was coerced into authenticating to the attacker via multiple RPC-based techniques.nxcAttacker Machine: Kali Linux — NXC, Rubeus, Evil-WinRM, krbrelayx, Impacket, DNS manipulation toolResponderTools like Responder or ntlmrelayxRubeusAttacker Machine: Kali Linux — NXC, Rubeus, Evil-WinRM, krbrelayx, Impacket, DNS manipulation tool