RelayInformer — Relay Assessment

The RelayInformer module evaluates whether network services (SMB, LDAP, HTTP, MSSQL) are vulnerable to NTLM relay attacks. Before executing relay attacks, it’s critical to verify whether the target service requires signing or channel binding, as these mechanisms prevent relay.

All commands use the relay-informer prefix.

Compatible agents: Beacon, Gopher, Kharon
Platform: Windows

Key Concepts#

An NTLM relay attack intercepts an NTLM authentication and forwards it to another service to execute actions on behalf of the victim. For it to work:

1. The target service must not require signing (message signing)
2. The target service must not require channel binding (TLS channel binding)

RelayInformer checks both requirements without performing any attack — it only queries the service configuration.

relay-informer smb#

Checks whether the server requires SMB2 signing.

When to use: Before attempting relay to SMB (e.g., with ntlmrelayx, PsExec via relay). If SMB signing is required, relay to SMB will fail.

relay-informer smb DC01
relay-informer smb FILESERVER01
relay-informer smb 192.168.1.10

Interpreting results:

• Signing Required: NO → Vulnerable to SMB relay. You can forward captured authentications to this server.
• Signing Required: YES → Not vulnerable. Domain Controllers require SMB signing by default.

Note: By default, Domain Controllers require SMB signing, but member servers and workstations do not. Focus SMB relay attacks on non-DC machines.

relay-informer ldap#

Checks LDAP signing enforcement and LDAPS channel binding configuration on a Domain Controller.

When to use: Before attempting relay to LDAP/LDAPS (e.g., to modify ACLs, create machine accounts, configure RBCD). LDAP relay is extremely powerful because it allows direct directory modifications.

relay-informer ldap DC01
relay-informer ldap DC01.corp.local
relay-informer ldap all

Interpreting results:

• LDAP Signing: Not Required → Vulnerable to LDAP relay without TLS
• LDAPS Channel Binding: Not Required → Vulnerable to LDAPS relay
• Both Required → Not vulnerable to LDAP/LDAPS relay

Possible attacks when LDAP signing is not required:

• Create a machine account and configure RBCD for privilege escalation
• Add DCSync ACLs to a controlled user
• Add members to privileged groups
• Shadow Credentials via msDS-KeyCredentialLink write

relay-informer http#

Checks EPA (Extended Protection for Authentication) and channel binding configuration on HTTP/HTTPS services.

When to use: Before attempting relay to HTTP endpoints such as:

• AD CS (Certificate Services) enrollment endpoint
• Exchange Web Services (EWS)
• ADFS endpoints
• SharePoint

relay-informer http https://adcs.corp.local/certsrv/
relay-informer http https://exchange.corp.local/ews/
relay-informer http http://intranet.corp.local

Interpreting results:

• EPA: Not Enforced → Vulnerable to HTTP/HTTPS relay
• EPA: Enforced → Not vulnerable

Common case: HTTP relay to AD CS (ESC8) is one of the most effective attack chains. Coerce DC authentication → relay to ADCS HTTP enrollment → obtain DC certificate → DCSync.

relay-informer mssql#

Checks signing and channel binding configuration on a Microsoft SQL Server.

When to use: Before attempting relay to MSSQL to execute SQL queries with the victim’s privileges.

relay-informer mssql DB01
relay-informer mssql DB01.corp.local 1433 master
relay-informer mssql 192.168.1.50 1434 tempdb

Assessment Workflow#

# 1. Assess all protocols on DCs
relay-informer smb DC01
relay-informer ldap all
relay-informer http https://adcs.corp.local/certsrv/

# 2. Assess member servers
relay-informer smb FILESERVER01
relay-informer smb SQLSERVER01
relay-informer mssql SQLSERVER01

# 3. Based on results, plan the attack:
#    - SMB no signing → relay for command execution
#    - LDAP no signing → relay for AD manipulation
#    - HTTP no EPA → relay to ADCS for certificates
#    - MSSQL no signing → relay for SQL execution

Relationship with Other Modules#