Ntlm Relay Coercion

This is a comprehensive NTLM relay attack playbook that covers the full chain from credential capture to privilege escalation. It walks through Responder poisoning, mitm6 IPv6 takeover, and ntlmrelayx configurations for SMB, LDAP, ADCS, and MSSQL targets. The signing requirement matrix is especially useful since it clarifies which protocols can be relayed where. Includes decision trees for choosing between RBCD, shadow credentials, and ESC8 certificate attacks, plus cross-protocol relay gotchas like SMB to LDAP constraints. Load this when you're doing internal pentests and need to escalate from network access to domain admin through authentication relay chains.

skills.sh installs: 3.7K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill ntlm-relay-coercion --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: NTLM Relay and Authentication Coercion — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert NTLM relay and coercion techniques. Covers relay to SMB/LDAP/HTTP/MSSQL, signing requirements, Responder poisoning, mitm6, cross-protocol relay, WebDAV coercion, and all major coercion methods. Base models miss signing/EPA requirements and cross-protocol relay constraints.