NTLM Relay to Self (HTTP to LDAP) - Post Exploitation

MetasploitMetasploit exploitExploitRubyexploit_windows/local/ntlm_relay_2_self

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Metasploit local exploit module that performs an NTLM relay-to-self privilege escalation attack. It starts an HTTP-to-LDAP relay server, coerces the local machine account to authenticate, relays the NTLM authentication to a Domain Controller's LDAP service to write Shadow Credentials, obtains a Kerberos TGT via PKINIT, performs S4U2Proxy to impersonate Administrator, and uses psexec to gain SYSTEM access on the same host.

Backdoor review

No backdoor observed in reviewed code

The module performs a documented NTLM relay-to-self privilege escalation chain. All actions (starting a relay server, coercing authentication, writing shadow credentials, obtaining Kerberos tickets, and optional psexec) align with the stated exploit purpose. No concealed operator-directed harm, unrelated payload delivery, or deceptive behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagesruby
Target softwareMicrosoft WindowsActive DirectoryLDAP
Attack typesprivilege_escalationntlm_relaykerberos_attacklateral_movement
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit module of type 'exploit' that implements a multi-step privilege escalation chain. It actively coerces authentication, relays it, modifies AD objects, obtains Kerberos tickets, and launches a payload to gain SYSTEM access. This is code intended to exercise a vulnerability, not merely detect it.

modules/exploits/windows/local/ntlm_relay_2_self.rb:6modules/exploits/windows/local/ntlm_relay_2_self.rb:137-157modules/exploits/windows/local/ntlm_relay_2_self.rb:560-588

Requirements

  • Requires an existing Meterpreter session on the target Windows host.modules/exploits/windows/local/ntlm_relay_2_self.rb:40
  • The target system must be configured to allow NTLMv1 responses (LmCompatibilityLevel <= 2).modules/exploits/windows/local/ntlm_relay_2_self.rb:640-641
  • The session token must have the LOCAL SID (S-1-2-0) for the ETW WebClient service trigger.modules/exploits/windows/local/ntlm_relay_2_self.rb:667-671
  • A connected Metasploit database is required to track Kerberos tickets.modules/exploits/windows/local/ntlm_relay_2_self.rb:626-628

Observed behavior

  • Starts an HTTP relay server on the compromised host bound to the Meterpreter session.modules/exploits/windows/local/ntlm_relay_2_self.rb:146-148
  • Triggers the WebClient service via an ETW event using railgun to call EventRegister and EventWrite.modules/exploits/windows/local/ntlm_relay_2_self.rb:166-233
  • Coerces machine account authentication by calling EFS APIs (OpenEncryptedFileRaw, EncryptFile, DecryptFile) with a WebDAV UNC path pointing to the relay listener.modules/exploits/windows/local/ntlm_relay_2_self.rb:242-264
  • On relay success, creates an LDAP session and spawns a thread to run the post-relay chain.modules/exploits/windows/local/ntlm_relay_2_self.rb:267-285
  • Writes Shadow Credentials (msDS-KeyCredentialLink) to the machine's AD object via the shadow_credentials module.modules/exploits/windows/local/ntlm_relay_2_self.rb:307-308
  • Configures Resource-Based Constrained Delegation (RBCD) for the machine account to itself.modules/exploits/windows/local/ntlm_relay_2_self.rb:313-314
  • Obtains a Kerberos TGT via PKINIT using the shadow credentials certificate, then performs S4U2Proxy to get a service ticket impersonating Administrator.modules/exploits/windows/local/ntlm_relay_2_self.rb:319
  • Optionally executes psexec against the local host using the obtained Kerberos ticket to gain a new elevated session.modules/exploits/windows/local/ntlm_relay_2_self.rb:560-588
  • Performs cleanup by removing the added Shadow Credentials and RBCD delegation.modules/exploits/windows/local/ntlm_relay_2_self.rb:328-341
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
NTLM relay-to-self with shadow credentials and optional psexecThe module's behavior matches its description: it relays machine account NTLM authentication to LDAP, writes msDS-KeyCredentialLink, obtains a Kerberos ticket, and optionally executes psexec for SYSTEM access.modules/exploits/windows/local/ntlm_relay_2_self.rb:20-32
Option
RUN_PSEXEC defaults to falseThe module does not automatically attempt lateral movement; psexec is opt-in, reducing unintended harm.modules/exploits/windows/local/ntlm_relay_2_self.rb:66-69
Cleanup
Shadow credentials and RBCD delegation are removed after useThe module includes cleanup logic to remove the added KeyCredentialLink and RBCD delegation, consistent with a legitimate privilege escalation tool.modules/exploits/windows/local/ntlm_relay_2_self.rb:328-341
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata. Framework mixins, libraries, and external payloads referenced by the module are not included in the evidence.
  • The evidence does not include runtime behavior, execution results, or verification that the exploit works as described.
  • Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads are not expanded and could contain unrelated behavior.
  • Binary files were not present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.