NTLM Relay Attack Module

NTLM Relay Attack Module

Modular implementation of NTLM relay attacks for Active Directory:

• Multi-protocol listener — Captures NTLM authentication via SMB, HTTP, and WebDAV.
• Relay targets — Relays to SMB (psexec), LDAP/LDAPS (modify ACLs, add computer), MSSQL (xp_cmdshell), HTTP (Exchange EWS).
• Signing check — Automatically verifies which hosts have SMB signing disabled (required for SMB relay).
• Coercion integration — Documentation for combining with PetitPotam, PrinterBug, and DFSCoerce to force authentication.
• Shadow Credentials — Option to relay to LDAP to add msDS-KeyCredentialLink and obtain a TGT without knowing the password.

Based on: Impacket ntlmrelayx with UX and logging improvements.