SMB to LDAPS Relay

An operator uses SMB-based forced authentication (for example, an EFSRPC or other supported RPC coercion path) to make an in-scope Windows host authenticate to a controlled SMB listener, then relays the NTLM response to an LDAP/LDAPS service. If the target accepts the bind and the relayed identity has relevant directory permissions, the operator can perform only those LDAP operations allowed to that identity. This is NTLM relay, not exploitation of an SMB/LDAP software vulnerability; it does not itself recover plaintext credentials, grant administrator rights, execute remote code, or establish persistence.