Ntlmrelayx does not display domain/user when authenticating against target

[ch3ckm8]

I encountered the issue above, and it's the third time in 3 different environments. I have the latest impacket-ntlmrelayx and I am not sure how to pinpoint the bug or how to resolve it

[MatteoBP]

Are you perhaps using MS-EVEN coercion? As you can see in the following repo, this coercion technique uses the NT AUTHORITY\LOCAL SERVICE account which can't be used to authenticate on the network. https://github.com/evilashz/CheeseOunce

[ch3ckm8]

I use coercer (https://github.com/p0dalirius/Coercer) usually i get usernames and stuff but this happened when I tried to coerce a DC and relay to another

[MatteoBP]

Coercer also uses the MS-EVEN technique among the others.
Try running the techniques one by one instead of using --always-continue to understand which technique is causing the coercion.

[anadrianmanrique]

As @MatteoBP mentioned, can you provide which coercion technique are you actually using in order to authenticate against the relay?

[gabrielg5]

This same situation happens in #2060
When doing reflection in the context of ntlmrelayx