NTLM authentication and relay prerequisites

Mechanism

NTLM uses a challenge-response exchange rather than sending a plaintext password. A relay forwards an authentication exchange to another service, while offline cracking attempts to recover a secret from captured material. Relay viability depends on signing, channel binding, target protocol, identity permissions, and whether the client can be induced to authenticate.

Practical method

Map the source client, relay destination, and authentication protocol. Check target signing and channel-binding requirements before testing. In the lab, establish whether the relayed principal can perform a harmless target action. Keep captured-response analysis separate from live relay behavior.

client challenge-response -> relay -> target verifier
                                    target rights determine impact

Interpreting evidence

A captured response proves an authentication exchange occurred. It does not prove reusable password material or successful authorization at the relay destination.

Pitfalls and limits

SMB signing and Extended Protection can block relevant relays. Protocol conversions add constraints. A machine account and a user account may have very different permissions on the target.