Impacket ntlmrelayx.py

Back to the category index / Back to the command index

Overview

Relays received NTLM authentication to a selected target and runs the applicable attack module. It supports multiple inbound and outbound protocols.

Item	Details
Implementation	examples/ntlmrelayx.py
Category	SMB / MSRPC / NTLM
Size	611 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/ntlmrelayx.py -h for the current option definitions.

Argument	Description
-h / --help	Show help and exit.
-ts	Add a timestamp to each log message.
-debug	Enable debug output.
-t / --target	Relay target: an IP address, hostname, or URL such as domain\username@host:port. The domain\username and port are optional; escape the backslash. If omitted, relay back to the client.
-tf	File containing one target hostname or full URL per line.
-w	Watch the target file and update the target list automatically (requires -tf).
-i / --interactive	After a successful relay, launch an smbclient, LDAP console, or SQL shell instead of running a command. The console listens on a local TCP port and can be reached with netcat, for example.
-ip / --interface-ip	IP address on which relay servers bind (defaults to “0.0.0.0” or ”::”).
--no-smb-server	Disable the SMB server.
--no-http-server	Disable the HTTP server.
--no-wcf-server	Disable the WCF server.
--no-raw-server	Disable the RAW server.
--no-rpc-server	Disable the RPC server.
--no-winrm-server	Disable the WinRM server.
--no-mssql-server	Disable the MSSQL server.
--no-rdp-server	Disable the RDP server.
--smb-port	SMB server listening port (default: 445)
--http-port	HTTP server listening ports; separate ports with commas and ranges with a hyphen, for example 80,8000-8010 (default: 80)
--https	Enable TLS for the HTTP listener. Requires --certfile.
--certfile	PEM certificate for the HTTPS listener.
--keyfile	PEM private key when the certificate file does not contain it.
--wcf-port	WCF server listening port (default: 9389)
--raw-port	Raw server listening port (default: 6666)
--rpc-port	RPC server listening port (default: 135)
--mssql-port	MSSQL server listening port (default: 1433)
--rdp-port	RDP server listening port (default: 3389)
--no-multirelay	Disable multi-host relay on the SMB and HTTP servers.
--keep-relaying	Keep relaying to a target after a successful connection to it.
-ra / --random	Select targets at random.
-r	Redirect HTTP requests to a file:// path on SMBSERVER.
-l / --lootdir	Directory for gathered loot such as SAM hashes and optional LSA secrets (default: current directory).
-of / --output-file	Base filename for encrypted hash output; suffixes are added for NTLM and NTLMv2.
-dh / --dump-hashes	Show encrypted hashes in the console.
-codec	Help generated dynamically from the runtime value.
-smb2support	Enable SMB2 support.
-ntlmchallenge	NTLM server challenge used by the SMB server (16 hexadecimal bytes; for example, 1122334455667788).
-socks	Launch a SOCKS proxy for the relayed connection.
-socks-address	SOCKS5 server address, also used for the HTTP API (default: 127.0.0.1)
-socks-port	SOCKS5 server port (default: 1080)
-http-api-port	SOCKS5 HTTP API port (default: 9090)
-wh / --wpad-host	Serve a WPAD file for a proxy authentication attack, using the supplied proxy host.
-wa / --wpad-auth-num	Before serving a WPAD file, prompt clients without MS16-077 for authentication N times (default: 1).
-6 / --ipv6	Listen over IPv6.
--remove-mic	Remove the MIC (exploit CVE-2019-1040).
--remove-sign-seal	Remove SIGN/SEAL-related NTLM negotiate flags (exploit CVE-2025-33073).
--serve-image	Local path of the image returned to clients.
-c	Command to run on the target through SMB or RPC. If omitted for SMB, dump SAM hashes; use --dump-lsa to also dump LSA secrets. RPC provides no output.
--mssql-db	Database for MSSQL relay
-e	File to run on the target. If omitted, dump SAM hashes; use --dump-lsa to also dump LSA secrets.
--dump-lsa	Dump LSA secrets in addition to SAM hashes.
--enum-local-admins	If the relayed user is not an administrator, use SAMR to look up who is (only before Windows 10 Anniversary Update).
--rpc-attack	Attack to perform over RPC over named pipes (choices: None, TSCH, ICPR).
-rpc-mode	Protocol to attack (choices: TSCH, ICPR; default: TSCH).
-rpc-use-smb	Relay DCE/RPC to SMB pipes.
-auth-smb	Credential for SMB authentication (a low-privilege account).
-hashes-smb	See the argument definition in the source.
-rpc-smb-port	Destination SMB port (choices: 139, 445; default: 445)
-icpr-ca-name	CA name for the ICPR attack.
-q / --query	MSSQL query to run; may be specified multiple times.
-machine-account	Domain machine account used to obtain a session key for signing when interacting with the domain (format: domain/machine_name).
-machine-hashes	Domain machine hashes in LMHASH:NTHASH format.
-domain	Domain FQDN or IP address for NETLOGON.
-remove-target	Try to remove the target from the challenge message when the CVE-2019-1019 patch is absent.
--no-dump	Do not attempt to dump LDAP information.
--no-da	Do not attempt to add a Domain Admin.
--no-acl	Disable ACL attacks.
--no-validate-privs	Skip privilege enumeration and assume permission to escalate a user through ACL attacks.
--escalate-user	Escalate this user’s privileges instead of creating a new user.
--delegate-access	Delegate access on the relayed computer account to the specified account.
--sid	Identify the account for delegated access by SID instead of name.
--dump-laps	Attempt to dump LAPS passwords readable by the user.
--dump-gmsa	Attempt to dump gMSA passwords readable by the user.
--dump-adcs	Attempt to dump AD CS enrollment services and certificate template information.
--dump-info-attr	Attempt to dump the info attribute of all domain user and group objects; it may contain credentials.
--dump-pre2k	Enumerate computer accounts in LDAP that have predictable passwords used for pre-Windows 2000 authentication.
--add-dns-record	Add a DNS record pointing to through LDAP.
--add-computer	Attempt to add a computer account through SMB or LDAP, according to the target. Either service can be used if the target is a domain controller.
-k / --keyword	IMAP keyword to search for; if omitted, search for mail containing “password” (default: password).
-m / --mailbox	Mailbox to dump (default: INBOX).
-a / --all	Dump all emails instead of searching for keywords.
-im / --imap-max	Maximum number of emails to dump (0 means unlimited; default: no limit).
--adcs	Enable AD CS relay attacks.
--template	AD CS template; defaults to Machine or User depending on whether the relayed account name ends in $. Relaying a DC should require specifying DomainController.
--altname	Subject Alternative Name for ESC1 or ESC6 attacks.
--altsid	Object SID to embed in szOID_NTDS_CA_SECURITY_EXT (1.3.6.1.4.1.311.25.2). Required when StrongCertificateBindingEnforcement >= 1 (default on updated DCs since Feb 2025). Obtain with: lookupsid.py DOMAIN/user:pass@DC | grep ” 500$”
--enum-templates	Enumerate enabled AD CS templates accessible to the relayed account.
--shadow-credentials	Enable a Shadow Credentials relay attack by modifying msDS-KeyCredentialLink for PKINIT pre-authentication.
--shadow-target	User or computer account whose msDS-KeyCredentialLink to populate.
--pfx-password	Password for the PFX containing the self-signed certificate. Generated randomly if omitted; unnecessary when exporting PEM.
--export-type	Export the certificate and private key as PEM or PFX (PKCS#12); default: PFX (choices: PEM, PFX).
--cert-outfile-path	Filename for the generated self-signed PEM or PFX certificate and key.
--shadow-replace	Back up existing Shadow Credentials KeyCredentials to JSON, then replace them.
--backup-path	Path to the backup JSON saved by --shadow-replace.
--sccm-policies	Enable an SCCM policies attack by registering a device and dumping secret policies from a Management Point. Works best when relaying a machine account. Target: ‘http:///ccm_system_windowsauth/request’.
--sccm-policies-clientname	Name of the client registered to dump secret policies (default: relayed account name).
--sccm-policies-sleep	Seconds to wait after client registration before requesting secret policies.
--sccm-dp	Enable an SCCM Distribution Point attack and dump package files. Target: ‘http:///sms_dp_smspkg$/Datalib’.
--sccm-dp-extensions	File extensions to download from the Distribution Point (default: .ps1,.bat,.xml,.txt,.pfx).
--sccm-dp-files	File containing specific URLs to download from the Distribution Point instead of downloading by extension; skips file indexing.

Related techniques: NTLM / SPNEGO Type 1/2/3, MIC, and CBT; SMB; DCE/RPC.

Detailed processing flow

The CLI builds an NTLMRelayxConfig, then starts the target processor and enabled listener servers. A server relays inbound negotiation to a protocol client and, after successful authentication, hands the connection to an attack plugin or SOCKS session. The target file watcher, mini shell, and API thread share the same configuration and state. On exit, the tool stops the servers.

How it works

NTLM relay links two authentication conversations: one with an inbound client and one with an outbound target. The listener negotiates with the client as a server and returns a challenge, while connecting to the target as a client. It forwards the client’s AUTHENTICATE message to the target session and hands the authenticated connection to an attack or SOCKS layer only if the target accepts it.

ntlmrelayx.py does not implement all protocols in one place. The servers package handles inbound traffic, clients handles outbound traffic, attacks handles post-authentication actions, and TargetsProcessor selects targets. NTLMRelayxConfig passes CLI options to these components. SMB, HTTP, RPC, MSSQL, and other protocols frame messages differently, but share this authentication-token and relay lifecycle orchestration.

Targets track whether they have succeeded, are being attempted, or can be reused. Multi-relay, random selection, and target-file watching change these state transitions. In SOCKS mode, the authenticated connection stays open so a protocol plugin can multiplex later requests. In ordinary attack mode, the module runs immediately after authentication and records loot, output, and exit state. The default SMB attack dumps SAM hashes; LSA secrets are dumped only when --dump-lsa is set.

MIC, signing and sealing, channel binding, EPA, SMB signing, and target-name validation directly affect relay success. When adding an option, identify which inbound server, outbound client, or attack capability consumes it; adding a configuration field alone is insufficient. Stopping listener threads, the watcher, and SOCKS/API servers and synchronizing shared target state are part of the same feature.

Key implementation elements

Symbol	Location	Where to trace its responsibility
MiniShell	63	__init__(), printTable(), emptyline(), do_targets(), do_finished_attacks(), do_socks(), do_startservers(), do_stopservers(), do_exit(), do_EOF()
start_servers()	179	Module function
stop_servers()	267	Module function

Dependencies

Within Impacket

Module	Main names used
impacket	version
impacket.examples	logger
impacket.examples.ntlmrelayx.servers	HTTPRelayServer, MSSQLRelayServer, RAWRelayServer, RDPRelayServer, RPCRelayServer, SMBRelayServer, WCFRelayServer, WinRMRelayServer, WinRMSRelayServer
impacket.examples.ntlmrelayx.utils.config	NTLMRelayxConfig, parse_listening_ports
impacket.examples.ntlmrelayx.utils.targetsutils	TargetsFileWatcher, TargetsProcessor
impacket.examples.ntlmrelayx.servers.socksserver	SOCKS
impacket.examples.ntlmrelayx.clients	PROTOCOL_CLIENTS
impacket.examples.ntlmrelayx.attacks	PROTOCOL_ATTACKS

Output, side effects, and required privileges

• Some operations change the target’s state. Check the target name, SID, and path before making changes.
• The tool starts listening sockets or long-running loops. Check bind addresses, ports, shutdown behavior, and shared state under concurrent connections.

Failure paths and cleanup

• stop_servers(), do_finished_attacks(), and do_stopservers() participate in cleanup. Check that new early returns and exception paths still reach them.
• Check that shutdown requests, client disconnections, partial reads or writes, and worker exceptions do not leave the whole listener inconsistent.

When changing the implementation

The code depends on impacket.examples.ntlmrelayx.servers, clients, attacks, utils, the SOCKS server, flask, and others. The CLI has a large configuration surface, so when adding an option, update the corresponding server, client, or attack capability and validation at the same time.

Verification

• Syntax: python -m py_compile examples/ntlmrelayx.py
• CLI: python examples/ntlmrelayx.py -h
• Related test: tests/misc/test_socksserver.py
• Related test: tests/misc/test_tds.py