---
id: 9498
title: "Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2025/08/22/operating-outside-the-box-ntlm-relaying-low-privilege-http-auth-to-ldap/"
published_at: "2025-08-22T16:00:00Z"
phying_url: "https://phying.com/item/9498"
lang: en
---

# Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP

## Summary

TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to LDAP, then execute tooling through the SOCKS5 proxy to complete LDAP- related objectives completely off-host. Introduction Typically, when operating using command and control […]

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2025-08-22T16:00:00Z
- **Original:** https://specterops.io/blog/2025/08/22/operating-outside-the-box-ntlm-relaying-low-privilege-http-auth-to-ldap/
- **Phying News:** https://phying.com/item/9498