Agent skill · security · yaklang
ntlm-relay-coercion
NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay targets, combined with PetitPotam, PrinterBug, and other coercion methods.
Why this skill is useful
Adds detailed attack playbook with executable commands and techniques for NTLM relay and coercion that are not widely known.
What it needs
Requires crackmapexec, nmap, responder installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: NTLM Relay and Authentication Coercion — Expert Attack Playbook AI LOAD INSTRUCTION: Expert NTLM relay and coercion techniques. Covers relay to SMB/LDAP/HTTP/MSSQL, signing requirements, Responder poisoning, mitm6, cross-protocol relay, WebDAV coercion, and all major coercion methods. Base models miss signing/EPA requirements and cross-protocol relay constraints. 0. RELATED ROUTING Before going deep, consider loading: active-directory-certificate-services for ESC8 (relay to ADCS enrollment) active-directory-acl-abuse for ACL modification via LDAP relay (RBCD, shadow creds) active-directory-kerberos-attacks for Kerberos attacks after relay success windows-lateral-movement for post-relay lateral movement Advanced Reference Also load COERCIONMETHODS.md when you need: Detailed coercion method comparison (PetitPotam, PrinterBug, DFSCoerce, etc.) RPC function-level details and prerequisites Coercer tool usage and discovery --- 1. NTLM RELAY FUNDAMENTALS NTLMv1 vs NTLMv2 Feature NTLMv1 NTLMv2 --- --- --- Security Weak (crackable to NTLM hash) Stronger (but still relayable) Relay Yes Yes Crack to hash Yes (rainbow tables, crack.sh) Offline brute-force only Downgrade Force via Responder --lm Default in modern Windows --- 2. RELAY TARGET MATRIX Target Protocol What You Get Signing Required by Default? EPA/Channel Binding? --- --- --- --- SMB Command exec (if admin), file access DCs: Yes, Workstations: No No LDAP ACL modification, RBCD, shadow creds, add computer DCs: No (negotiated) No (unless configured) LDAPS Same as LDAP but encrypted N/A Yes (channel binding) HTTP (ADCS) Certificate enrollment (ESC8) No Depends on config MSSQL SQL queries, xpcmdshell No No IMAP/SMTP Email access No No RPC Various (CA enrollment for ESC11) Depends No Signing Check --- 3. RESPONDER — CREDENTIAL CAPTURE LLMNR/NBT-NS/WPAD/mDNS Poisoning Responder + Relay (Don't Capture, Relay Instead) --- 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/ntlm-relay-coercion