Project 89: NTLM Security Analysis

Module: Module 9: Post-Exploitation Detection & Active Directory Security  |  Level: Advanced  | 
Primary tool: Responder (free, defensive-analysis use) or log review  |  Estimated time: 2–4 hours

Objective: Understand NTLM relay/capture risk and how to recognize it in logs.

Free lab environment

GOAD — Game of Active Directory (free, self-deployed) — https://github.com/Orange-Cyberdefense/GOAD

GOAD is a free, open-source, fully scripted vulnerable Active Directory lab you deploy yourself in Vagrant/VirtualBox — the standard free option for practicing AD security concepts legally in an isolated environment. A lighter free alternative is TryHackMe’s ‘Attacktive Directory’ room.

Lab workflow

1. Deploy a GOAD lab deployment or documented public write-ups for analysis practice inside an isolated lab network — never point AD/SMB enumeration tools at a production or shared network.
2. Using Responder (free, defensive-analysis use) or log review, enumerate what is reachable, with the specific goal of understand NTLM relay/capture risk and how to recognize it in logs.
3. For each item enumerated without authentication, ask: should this really be reachable anonymously?
4. Identify the single most sensitive item exposed and write its specific remediation (a config change, not a vague ‘restrict access’).
5. If possible, apply that fix in your lab and re-run the enumeration to confirm the exposure is gone.
6. Summarize your findings as if briefing a system administrator who needs to act on them today.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your written analysis of an NTLM authentication log sequence, noting the risk indicator
• your written remediation (e.g. disabling NTLM where Kerberos is available, SMB signing) for that specific risk

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.