Impacket ntlmrelayx (LDAP)

ntlmrelayx.py -t ldaps://<dc> --escalate-user <user>

Relay NTLM authentications to an LDAP domain controller to escalate privileges (e.g., add user to Domain Admins).

When you have captured an NTLM authentication from a host (e.g., via PetitPotam) and want to relay it to LDAP to modify AD. Allows adding a user to Domain Admins without needing credentials.

If the DC has LDAP signing or channel binding enabled (the relay will fail). Also if the source host has mandatory SMB signing.