--- title: There and Back Again: An Operators Guide on NTLM... description: A detailed operator's guide from SpecterOps describes 'There and Back Again,' a technique for coercing outbound NTLM authentication (via SMB or WebDAV/EFSRPC)... canonical: https://daily.dev/posts/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress-abtnrncrz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: There and Back Again: An Operators Guide on NTLM Relaying Egress | daily.dev og:description: A detailed operator's guide from SpecterOps describes 'There and Back Again,' a technique for coercing outbound NTLM authentication (via SMB or WebDAV/EFSRPC)... og:url: https://daily.dev/posts/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress-abtnrncrz og:image: https://api.daily.dev/og/posts/ABtNRNCrz.png og:image:alt: There and Back Again: An Operators Guide on NTLM Relaying Egress og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # There and Back Again: An Operators Guide on NTLM Relaying Egress **[SpecterOps](https://daily.dev/sources/specterops)** · 16 min read · 0 upvotes · 0 comments ## Summary A detailed operator's guide from SpecterOps describes 'There and Back Again,' a technique for coercing outbound NTLM authentication (via SMB or WebDAV/EFSRPC) from a target network, catching it on an internet-facing cloud VM, and relaying it back through red team infrastructure into the client environment to compromise ADCS web enrollment endpoints or LDAP/LDAPS. The post walks through Azure VM setup, iptables port redirection, SSH reverse tunnels, SOCKS5 proxying, DNS record injection via Kerberos tickets, EFS/WebClient service triggering, shadow credentials abuse, and S4U2Self ticket forgery to achieve local and domain privilege escalation. Defensive guidance covers enabling LDAP signing/channel binding, EPA on ADCS endpoints, and restricting SMB/firewall egress. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can you relay NTLM authentication when you only have low-privilege C2 access and no layer 2 network access? Coerce outbound NTLM authentication (via SMB or WebDAV/EFSRPC) to an internet-facing cloud VM, then tunnel that captured traffic back to red team infrastructure and proxy it into the target environment against a vulnerable service such as an ADCS web enrollment endpoint or LDAP/LDAPS. This technique, called 'There and Back Again,' bypasses the need for local administrator rights or direct 445/TCP binding. _Teams researching NTLM relay tradecraft and AD hardening can track new offensive techniques on daily.dev._ ### Why does enabling WebDAV coercion over port 443 bypass firewall rules that block SMB egress? WebClient/WebDAV authentication can be coerced over port 443/TCP instead of the traditional 445/TCP used by SMB, and most organizations only restrict SMB egress while leaving 443 open for normal HTTPS traffic. By starting the WebClient service locally via an ETW trigger and coercing EFSRPC authentication, an attacker routes NTLM traffic through 443 to an internet-facing host, evading typical firewall controls. _Defenders tightening egress firewall rules can follow AD security research like this on daily.dev._ ### What is the recommended LDAP channel binding setting to prevent NTLM relay attacks while maintaining compatibility with legacy systems? Set LDAP signing to Enabled and LDAPS channel binding to 'When Supported' rather than a stricter enforced mode. This configuration lets legacy systems still connect to LDAPS without channel binding while blocking NTLM relay attacks against LDAPS, since the default WebDAV Windows client always includes the channel binding token, which stops relay attempts. _Developers hardening Active Directory configurations can follow practical defensive guidance on daily.dev._ ## Similar posts on daily.dev - [HTB: Mirage](https://daily.dev/posts/htb-mirage-jymabso8x) · 0xdf hacks stuff · 1 upvotes · 0 comments - [ShadowGate Active Directory Lab Walkthrough \[HackSmarter\]](https://daily.dev/posts/shadowgate-active-directory-lab-walkthrough-hacksmarter--ovegbtw2c) · InfoSec Write-ups · 1 upvotes · 0 comments - [Lateral movement risk rises as enterprises emphasize convenience over containment](https://daily.dev/posts/lateral-movement-risk-rises-as-enterprises-emphasize-convenience-over-containment-feaxw8m31) · CSO Online · 0 upvotes · 0 comments - [You Thought It Was Over? Authentication Coercion Keeps Evolving](https://daily.dev/posts/you-thought-it-was-over-authentication-coercion-keeps-evolving-d3hz5unkp) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#active-directory](https://daily.dev/tags/active-directory), [#kerberos](https://daily.dev/tags/kerberos) [View this post on daily.dev](https://daily.dev/posts/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress-abtnrncrz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"There and Back Again: An Operators Guide on NTLM Relaying Egress","url":"https://daily.dev/posts/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress-abtnrncrz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress-abtnrncrz"},"datePublished":"2026-08-23T12:16:30.762Z","dateModified":"2026-08-23T12:18:38.900Z","description":"A detailed operator's guide from SpecterOps describes 'There and Back Again,' a technique for coercing outbound NTLM authentication (via SMB or WebDAV/EFSRPC)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a778b5a4d5840b1bf49b5f5646729387?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a778b5a4d5840b1bf49b5f5646729387?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress-abtnrncrz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,active-directory,kerberos","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"There and Back Again: An Operators Guide on NTLM Relaying Egress"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress-abtnrncrz#faq","mainEntity":[{"@type":"Question","name":"How can you relay NTLM authentication when you only have low-privilege C2 access and no layer 2 network access?","acceptedAnswer":{"@type":"Answer","text":"Coerce outbound NTLM authentication (via SMB or WebDAV/EFSRPC) to an internet-facing cloud VM, then tunnel that captured traffic back to red team infrastructure and proxy it into the target environment against a vulnerable service such as an ADCS web enrollment endpoint or LDAP/LDAPS. This technique, called 'There and Back Again,' bypasses the need for local administrator rights or direct 445/TCP binding. Teams researching NTLM relay tradecraft and AD hardening can track new offensive techniques on daily.dev."}},{"@type":"Question","name":"Why does enabling WebDAV coercion over port 443 bypass firewall rules that block SMB egress?","acceptedAnswer":{"@type":"Answer","text":"WebClient/WebDAV authentication can be coerced over port 443/TCP instead of the traditional 445/TCP used by SMB, and most organizations only restrict SMB egress while leaving 443 open for normal HTTPS traffic. By starting the WebClient service locally via an ETW trigger and coercing EFSRPC authentication, an attacker routes NTLM traffic through 443 to an internet-facing host, evading typical firewall controls. Defenders tightening egress firewall rules can follow AD security research like this on daily.dev."}},{"@type":"Question","name":"What is the recommended LDAP channel binding setting to prevent NTLM relay attacks while maintaining compatibility with legacy systems?","acceptedAnswer":{"@type":"Answer","text":"Set LDAP signing to Enabled and LDAPS channel binding to 'When Supported' rather than a stricter enforced mode. This configuration lets legacy systems still connect to LDAPS without channel binding while blocking NTLM relay attacks against LDAPS, since the default WebDAV Windows client always includes the channel binding token, which stops relay attempts. Developers hardening Active Directory configurations can follow practical defensive guidance on daily.dev."}}]} ```