펜테스팅 위키
  • Welcome
    • Home
  • 정보 수집
    • OSINT
      • Sub Domain
      • Google Hacking
      • Github
      • IP Address
      • Employees
    • 내부망
      • RID Cycling
      • Password Spraying
      • Password Must Change
      • Extension
        • xlsx/ods
        • pfx
        • vhd
        • pst
        • vbs
        • hc
      • Protocol
        • 21 - FTP
        • 22 - SSH
        • 25 - SMTP
        • 23 - Telnet
        • 53 - DNS
        • 80/443 - HTTP
        • 88 - Kerberos
        • 111 - RPC
        • 135 - msrpc
        • 139/445 - SMB
        • 389/636 - LDAP
        • 1433 - MSSQL
        • 5985/5986 - wsman
  • 초기 침투
    • CVEs
      • CVE-2025-31486
    • Phishing
      • Command File
      • EXE + LNK
      • wax
      • Microsoft Word
    • Web
      • Quary Language
        • SQL
        • GraphQL
      • File Upload
      • File Download
      • XSS
      • SSRF
      • CSRF
      • Open Redirect
      • SOP / CORS
    • ZIP Slip
  • 지속성
    • Active Directory
      • Golden Ticket
      • DC Shadow
      • RID Hijacking
    • Local
      • Task Scheduler
      • Startup Folder
      • Registry AutoRun
      • COM
      • WMI Event Subscription
      • SSH Key Injection
      • DLL Hijacking
      • DLL SideLoading
      • Create Account
  • 권한 상승
    • Active Directory
      • DACL
        • ReadGMSAPassword
        • ReadLAPSPassword
        • ForceChangePassword
        • AddSelf
        • WriteOwner
        • GenericAll
        • GenericWrite
        • WriteSPN
        • AddMembers
        • WriteProperty
        • WriteGPO
        • AddAllowedToAct
        • AllExtendedRights
      • AD CS
        • Abuse Permissions
        • ESC1
        • ESC2
        • ESC3
        • ESC4
        • ESC5
        • ESC6
        • ESC7
        • ESC8
        • ESC9
        • ESC10
        • ESC11
        • CVE-2022-26923
        • Non-PKINIT
      • MS14-068
      • Server Operators
      • DnsAdmins
      • noPac
      • Silver Ticket
      • KrbRelayUp
    • Windows
      • SeImpersonatePrivilege
      • Unquoted Service Path
      • Weak Service Permissions
      • Weak Service Binary Permissions
      • UAC Bypass
      • Always Install Elevated
      • Autoruns
      • Credential Manager
      • Local Service Account
  • 민감정보 탈취
    • Active Directory
      • DCSync
      • LSASS
      • AS-REP-Roasting
      • AS Requested Service Tickets
      • Kerberoasting
      • Targeted Kerberoast
      • Shadow Credentials
      • Backup Operators
      • SeEnableDelegationPrivilege
    • Windows
      • Unattended File
      • Browser Stored Credentials
      • NTLM Relay
      • Hard-coding Credentials
      • SeBackupPrivilege
  • 측면 이동
    • File Transfer
      • SCP
      • ZIP
      • ncat
      • Python
      • PowerShell
      • certutil
      • wget
      • SMB
      • Base64
      • FTP
      • WebDav
      • cURL
    • Port Forwarding
    • SMB/Windows Admin Shares
    • RDP
    • DCOM
    • WinRM
    • Domain Trust Discovery
  • ETC
    • CS
      • Kerberos
      • NTLM
      • PKINIT
      • Integrity
      • Registry
      • Active Directory Trusts
      • Delegation
      • OAuth 2.0
      • S4U
    • Tools
      • Cobalt Strike
      • BloodHound
      • Certipy-ad
      • LDAP Search
      • Hydra
Powered by GitBook
On this page

Was this helpful?

Export as PDF
  1. 민감정보 탈취
  2. Windows

NTLM Relay

PreviousBrowser Stored CredentialsNextHard-coding Credentials

Last updated 5 months ago

Was this helpful?

NTLM Relay는 NTLM 프로토콜의 매커니즘을 악용한 공격입니다.

NTLM 인증 과정에서 클라이언트와 서버는 챌린지를 위한 통신을 하는데

공격자가 중간에 개입하여 서버가 전송한 챌린지를 클라이언트에게 전송하고,

클라이언트가 한 응답을 서버에 전송한다면

공격자는 클라이언트의 NT Hash를 모르고도 클라이언트의 권한을 얻게 됩니다.

References

LogoNTLM Relayhackndo
LogoWhat is SMB Signing and do I need it?InfoSec Governance -
https://en.hackndo.com/ntlm-relay/