38. Active Directory Attacks and Defence
38.5 NTLM Relay and Pass-the-Hash Concepts (Lab Only)
Pass-the-Hash (PtH): NTLM hash milala (example: from memory dump on a machine YOU own) tar password crack shivay authenticate – protocol design. NTLM relay: coerce/auth capture → forward to another service that accepts NTLM without signing/channel binding.
Impacket names Blue must know to stop: ntlmrelayx.py, secretsdump.py (DCSync / SAM dump styles need high privilege – only on YOUR lab DC after you grant rights). Frame: "What must Blue disable so these fail?"
Blue controls: SMB signing required; LDAP signing + channel binding; disable NTLM where feasible; LAPS / Windows LAPS for unique local admin passwords; Credential Guard; Protected Users group for admins; Tier model (DA never logs into Tier-2 workstation); EPA for AD CS if used.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Relays NTLM to LDAP/SMB/HTTP when signing off | Enforce SMB signing; LDAP signing + channel binding; Extended Protection |
| Pass-the-Hash with stolen NTLM | Credential Guard; LSA protection; disable NTLM; rotate on compromise |
secretsdump.py style dump after DA |
Alert DCSync-like replication rights abuse (4662); Tier-0 hardening; PAM / JIT admin |
Ravindra Bagale's Tip
Students see secretsdump succeed and upload a video. That is lab proof – publicly dumping even lab hashes is careless. Focus on the interview answer: "SMB signing and LDAP channel binding stop many relays; LAPS stops lateral with one local hash." Defence sentence first, tool name later.
Ravindra Bagale's Tip – मराठी
Students secretsdump success बघून video upload करतात. हा lab proof आहे – lab hashes चा पण public dump करणे बेजबाबदार आहे. Interview answer वर focus करा: "SMB signing and LDAP channel binding stop many relays; LAPS stops lateral with one local hash." Defence चे वाक्य आधी, tool name नंतर.
Ravindra Bagale's Tip – हिंदी
Students secretsdump success देखकर video upload कर देते हैं. यह lab proof है – lab hashes का भी public dump करना लापरवाही है. Interview answer पर focus करो: "SMB signing and LDAP channel binding stop many relays; LAPS stops lateral with one local hash." Defence वाला वाक्य पहले, tool name बाद में.
Practice task
Notes madhe 6-row table: control (SMB signing / LDAP signing / channel binding / LAPS / Credential Guard / Tier model) | kay rokto | lab madhe kasa verify (high level). Amir (fictional junior SOC) la 8-line mail draft: "Why DA interactive logon on a Win10 helpdesk PC is dangerous."
Real incident: identity + lateral lessons after major worm outbreaks (2017)
Public post-incident writing on NotPetya/EternalBlue-era movement stressed that once credential material and SMB trust were available, many networks saw rapid east-west spread. Reported lesson for defenders: patch, segment, reduce NTLM, unique local passwords (LAPS). Source: national CERT and major vendor postmortems (verify).