I’m bringing relaying back: A comprehensive guide on…

This blog post provides a comprehensive, hands-on walkthrough of NTLM relaying and Active Directory abuse techniques. Using a Windows lab, the author demonstrates reconnaissance with Responder and CrackMapExec, classic SMB-to-SMB relays, SOCKS proxy chaining, LDAP/LDAPS relays (including creating computer accounts), resource-based constrained delegation abuse, shadow-credential PKINIT attacks, and certificate-enrollment (ESC8) abuse — illustrating how broadcast protocols, coerced authentication (PetitPotam/printerbug), and AD misconfigurations can enable domain compromise. The post lists required tools, demonstrates exploit sequences, and concludes with defensive advice such as disabling broadcast protocols and patching tier-0 systems.