XUTS LABS
Back to Red Team Playbooks
Active DirectoryRed Team Playbook

NTLM Relay

Assess relay viability only when active relay testing is in scope and explicitly approved.

NTLMRelaySMB

Purpose

Separate safe relay-list generation from active coercion or credential dumping.

Inputs

  • - CIDR
  • - relay target file
  • - approved listener interface

Prerequisites

  • - Relay allowed by rules
  • - Network position
  • - Targets without required signing/channel binding

Operator Assumptions

  • - Generate relay targets before attempting relay.
  • - Coercion and dumping require explicit approval.

Commands

Relay target list

Kali
netexec smb CIDR --gen-relay-list relay-targets.txt

Why: Find SMB targets where signing does not block relay.

Expected: A list of relayable hosts.

Relay listener

Kali
ntlmrelayx.py -tf relay-targets.txt --no-smb2support

Why: Start relay workflow after approval.

Expected: Listener waits for inbound authentication.

Decision Points

  • - If SMB signing is required everywhere, do not relay.
  • - If coercion is prohibited, stop at viability evidence.
  • - If ADCS is present, review ADCS playbook before action.

Follow-On Actions

  • - ADCS Enumeration
  • - SMB hardening finding
  • - Execution proposal

Evidence To Capture

  • - Relay target list
  • - Signing status
  • - Approval record
  • - Listener logs if executed

Common Failures

  • - Wrong interface
  • - Firewall blocks inbound auth
  • - SMB signing required

Operational Cautions

  • - Relay/coercion is noisy and high-risk.
  • - Do not run dumping flags by default.

Related Content

Ask EXO