[Intro] Yo, listen up, yeah Relay inna di dark, bring di lights up (Crew: Borrow! Borrow!) [Verse 1] Server authenticate pon di wrong host, mi tell yuh, nuh panic Attacker just a pass di exchange on, valid NTLM response, straight through Name-resolution poisoning can draw yuh in, but relay can run without it, seen? Di identity borrow, di password never need fi be found [Chorus] Nuh crack, just borrow! NTLM relay! Lock di receiver, shut di door, yuh hear mi say! Require EPA pon AD CS, di Required option, pon every web enrolment HTTPS alone nuh enough, don't yuh guess, don't yuh guess! (Crew: Require EPA!) EPA, EPA, EPA, chop it up! [Verse 2] Certificate fi di server account, and it outlive di web visit, ya see Kerberos ticket-granting ticket come after, domain compromise, nuh just a browser session Certificate Enrollment Web Service need di Web.config change too, don't skip it LDAP nuh same as IIS, so review di signing, channel-binding, against di directory docs, no assumptions [Bridge] (Percussion only, spoken over the drop) Map every NTLM endpoint, who authenticate and what authority dem hold Not every event equal, yuh feel mi? Check di destination, check di identity [Chorus] Nuh crack, just borrow! NTLM relay! Lock di receiver, shut di door, yuh hear mi say! Require EPA pon AD CS, di Required option, pon every web enrolment HTTPS alone nuh enough, don't yuh guess, don't yuh guess! (Crew: Require EPA!) EPA, EPA, EPA, chop it up! [Outro] Borrow nuh mean crack, bredrin, lock it down (Crew: Nuh crack, just borrow!) Lock it down, lock it down
