RelayKing-Depth

RelayKing v1.10 Dominate the domain. Relay to royalty. RelayKing is a comprehensive relay detection and enumeration tool designed to identify relay attack opportunities in Active Directory environments. Actual reporting options. Comprehensive attack coverage. Find the hidden relay vectors and...

CVE-2022-30216

CVE-2022-30216 A Zeek package which raises notices for attempts and exploits of CVE-2022-30216, a technique used against Windows Server to force an NTLM authorization to an arbitrary server. An attacker can reuse the NTLM token to generate a client certificate, enabling them to request a Kerberos...

ExchangeRelayX

ExchangeRelayX Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking...

lsarelayx

lsarelayx Introduction lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the...

cyanide

What is Cyanide? As the name suggests, it's poison. Cyanide is essentially a tracker for correlating various poisoning techniques currently only Responder is used in conjuction with relaying the captured hashes via Impackets ntlmrelayx.py. On startup it will start Responder without SMB, HTTP, or...

SharpRelay

Usage The only requirement for this attack to work is to have a beacon with local administrator privileges or with the ability to load drivers. The attack using SharpRelay works as follows: Upload the signed WinDivert driver into any folder on the compromised host Run SharpRelay to modify the...

MSSqlPwner

MSSqlPwner MSSqlPwner is an advanced and versatile pentesting tool designed to seamlessly interact and pwn MSSQL servers. That tool is based on impacket, which allows attackers to authenticate to databases using clear-text passwords NTLM Hashes, and kerberos tickets. With MSSqlPwner, users can...

NtlmRelayToEWS

ntlmRelayToEWS Author: Arno0x0x - @Arno0x0x ntlmRelayToEWS is a tool for performing ntlm relay attacks on Exchange Web Services EWS. It spawns an SMBListener on port 445 and an HTTPListener on port 80, waiting for incoming connection from the victim. Once the victim connects to one of the...

CVE-2025-33073

CVE-2025-33073 Reflection Relay PoC Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled. 📋 Overview CVE-2025-33073 is a critical vulnerability that allows attackers to achieve SYSTEM-level code execution on Windows Domain...

smbAutoRelay

DISCLAIMER : I AM NOT RESPONSIBLE OF THE MISUSE OF THIS TOOL. YOU RUN IT AT YOUR OWN RISK. Before running it, make sure you are in a controlled environment, and where you are allowed to perform this kind of exercise. PLEASE BE KIND : SMB AutoRelay SMB AutoRelay provides the automation of SMB/NTLM...

DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

UnCanny

UNCanny Coerce The idea behind this research was simple as i wanted to find my own coercion technique. i started by looking for new RPC attack surfaces, but after microsoft added RPC activity monitoring...

LdapRelayScan

LDAP Relay Scan A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication. If you're interested in the specifics of the error-based enumeration, see below. For details regarding what can be done when you identify a lack of LDAP protections, see the...

Certipy

Certipy - AD CS Attack & Enumeration Toolkit Certipy is a powerful offensive and defensive toolkit for enumerating and abusing Active Directory Certificate Services AD CS. It helps red teamers, penetration testers, and defenders assess AD CS misconfigurations - including full support for...

relay_bible

Relay Bible — Internal Penetration Testing Relay Guide A comprehensive reference for NTLM relay attacks during authorized internal penetration tests. Covers authentication fundamentals, coercion techniques, per-protocol relay targets, tooling, advanced chaining, and defensive mitigations...

RemotePotato0

RemotePotato0 UPDATE 21-10-2022: The main exploit scenario RPC- LDAP of RemotePotato0 has been fixed. More details at -- https://twitter.com/splintercode/status/1583555613950255104 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that...

ZackAttack

===== ZackAttack! - Realying NTLM Like Nobody's Business ======= WTF Is This? tl;dr version - ZackAttack! is a new Tool Set to do NTLM Authentication relaying unlike any other tool currently out there. = So how is ZackAttack! different / better? Compared to other tools... Supports NTLMv2 : Brings...

CVE-2022-24853

CVE-2022-24853 Metabase NTLM Reflection / Relay Attack CVE-2022-24853 Blog Post about the finding: https://secure77.de/metabase-ntlm-relay-attack/ Github Security Advisory: https://github.com/metabase/metabase/security/advisories/GHSA-5cfq-582c-c38m POC...

UltraRealy_with_CVE-2019-1040

UltraRelay Updated by Lazaar Sami for the exploit CVE-2019-1040 UltraRelay is a tool for LLMNR poisoning and relaying NTLM credentials. It is based on Responder and impack. I have updated the original version https://github.com/5alt/ultrarelay for the exploit CVE-2019-1040. Dirk-jan Mollema has...

PowerPriv

PowerPriv DESCRIPTION A powershell implementation of PrivExchange by @dirkjan original code found here: https://github.com/dirkjanm/PrivExchange/blob/master/privexchange.py Useful for environments on which you cannot run python-based applications, have user credentials, or do not want to drop fil...