An LDAP relay attack is an NTLM relay aimed at a domain controller's LDAP (or LDAPS) service. The attacker coerces or captures a victim's NTLM authentication and forwards it to LDAP; if LDAP signing and channel binding are not enforced, the relayed session performs privileged writes as the victim, for example granting resource-based constrained delegation or adding shadow credentials to take over a target account. Defend by enforcing LDAP signing and channel binding, disabling NTLM, and reducing coercion surfaces.
What an LDAP relay attack is
NTLM relay forwards an authentication to a service that will act on it. When the target is a domain controller's LDAP interface and signing is not enforced, the relayed session can modify directory objects as the victim. Because many privileged actions in AD are LDAP writes, relaying to LDAP is a direct route from a captured authentication to account takeover.
How the attack works
The attacker starts a relay to LDAP with ntlmrelayx.py -t ldap://<dc> --delegate-access (or --add-computer / shadow-credential options), then coerces a target machine to authenticate (via PetitPotam, the printer bug, or poisoning). The relayed session writes msDS-AllowedToActOnBehalfOfOtherIdentity (RBCD) or msDS-KeyCredentialLink (shadow credentials) on a target, after which the attacker impersonates it. Shown for defensive testing.
How to defend against it
Enforce LDAP signing and LDAP channel binding on domain controllers so relayed, unsigned sessions are rejected, and require LDAPS with Extended Protection for Authentication. Disable NTLM where possible, reduce coercion surfaces (patch PetitPotam and the printer bug, disable the Spooler on DCs), and monitor for RBCD and key-credential writes to sensitive accounts.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: How to enable LDAP signing(Microsoft)
Unsigned LDAP plus a coercible machine is a straight path to account takeover. Talk to a security expert about testing your relay exposure.