38. Active Directory Attacks and Defence
38.5 NTLM Relay and Pass-the-Hash Concepts (Lab Only)
Pass-the-Hash (PtH): NTLM hash milala (example: from memory dump on a machine YOU own) tar password crack shivay authenticate – protocol design. NTLM relay: coerce/auth capture → forward to another service that accepts NTLM without signing/channel binding.
Impacket names Blue must know to stop: ntlmrelayx.py, secretsdump.py (DCSync / SAM dump styles need high privilege – only on YOUR lab DC after you grant rights). Frame: "What must Blue disable so these fail?"
Blue controls: SMB signing required; LDAP signing + channel binding; disable NTLM where feasible; LAPS / Windows LAPS for unique local admin passwords; Credential Guard; Protected Users group for admins; Tier model (DA never logs into Tier-2 workstation); EPA for AD CS if used.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Relays NTLM to LDAP/SMB/HTTP when signing off | Enforce SMB signing; LDAP signing + channel binding; Extended Protection |
| Pass-the-Hash with stolen NTLM | Credential Guard; LSA protection; disable NTLM; rotate on compromise |
secretsdump.py style dump after DA |
Alert DCSync-like replication rights abuse (4662); Tier-0 hardening; PAM / JIT admin |
Ravindra Bagale's Tip
Students secretsdump success baghun video upload kartat. He lab proof ahe – public dump of even lab hashes careless aahe. Focus interview answer: "SMB signing and LDAP channel binding stop many relays; LAPS stops lateral with one local hash." Defence sentence aadhi, tool name nantar.
Practice task
Notes madhe 6-row table: control (SMB signing / LDAP signing / channel binding / LAPS / Credential Guard / Tier model) | kay rokto | lab madhe kasa verify (high level). Amir (fictional junior SOC) la 8-line mail draft: "Why DA interactive logon on a Win10 helpdesk PC is dangerous."
Real incident: identity + lateral lessons after major worm outbreaks (2017)
Public post-incident writing on NotPetya/EternalBlue-era movement stressed that once credential material and SMB trust were available, many networks saw rapid east-west spread. Reported lesson for defenders: patch, segment, reduce NTLM, unique local passwords (LAPS). Source: national CERT and major vendor postmortems (verify).