Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP
specterops.io | blog
Summary
TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to LDAP, then execute tooling through the SOCKS5 proxy to complete LDAP- related objectives completely off-host. Introduction Typically, when operating using command and control […]
- Published
- Collected
--- id: 9498 title: "Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP" source_domain: specterops.io source_url: "https://specterops.io/blog/2025/08/22/operating-outside-the-box-ntlm-relaying-low-privilege-http-auth-to-ldap/" published_at: "2025-08-22T16:00:00Z" phying_url: "https://phying.com/item/9498" lang: en --- # Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP ## Summary TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to LDAP, then execute tooling through the SOCKS5 proxy to complete LDAP- related objectives completely off-host. Introduction Typically, when operating using command and control […] ## Intelligence Metadata - **Sources:** specterops.io - **Published:** 2025-08-22T16:00:00Z - **Original:** https://specterops.io/blog/2025/08/22/operating-outside-the-box-ntlm-relaying-low-privilege-http-auth-to-ldap/ - **Phying News:** https://phying.com/item/9498