Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication
For years, we thought LDAP and SMB signing protected us from NTLM relay attacks. However, we found that both protocols could be relay targets through re-authentication on a connection the attacker already owned. Signing was still enforced, just with the attacker known session key. Microsoft fixed SMB quietly in September 2026 and LDAP in October […] The post Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication appeared first on SpecterOps.
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.