NTLM Relay Attack Module

NTLM Relay Attack Module

Standalone implementation of NTLM relay basada in impacket:

n
• Listener multi-protocol — Captura authentications NTLM entrantes via SMB, HTTP, and WebDAV.
n
• Relay targets — Retransmite a SMB (psexec, secretsdump), LDAP (modify ACLs, add computer), HTTP (Exchange EWS), MSSQL (xp_cmdshell).
n
• Coercion triggers — Scripts for forzar authentication: PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce.
n
• Filtrado — Relay selectivo by user (only relay Domain Admins, ignorar machine accounts).
n
• Logging — Registro detallado of each intento of relay with result (success/fallo and reason).
n

Requirements: Python 3 + impacket. Position of red that permita intercept or coercionar authentications NTLM.