NTLMquic

This post explains and demonstrates SMB over QUIC (ALPN "smb" on UDP/443) on Windows 11/Server 2022, provides PoC server code (Go and msquic), and shows how attackers can terminate QUIC and relay it to TCP/445 to reuse existing tooling (ntlmrelayx), coerce authentication via RPC methods like PetitPotam, and bypass traditional TCP/445 network restrictions—highlighting certificate requirements and practical deployment considerations.