ntlmrelayx
Relays captured NTLM authentications to another service (LDAP, SMB, ADCS).
Impacket's relay engine. It takes an NTLM authentication you've captured or coerced (with Responder, mitm6, Coercer or PetitPotam) and relays it to another service where that identity has rights: LDAP/LDAPS to grant rights or create a user, SMB to execute, or the ADCS web endpoint to request a certificate (ESC8). It doesn't crack the hash: it reuses it live.
Family NTLM coercion & relay
Flags -t ldaps:// -smb2support --delegate-access
Concepts NTLM Relay, NTLMv2 coercion with SCF/URL (IconFile UNC), Pass-the-Hash
Cheatsheet LLMNR / NBT-NS poisoning
Installation
# All of Impacket's *.py tools ship in the same package:
pipx install impacket
# invoke them as impacket-<tool> or <Tool>.py depending on the packagingUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.