NTLM Relay Gat: automate the exploitation of NTLM relays

by ddos · March 22, 2025

NTLM Relay Gat

NTLM Relay Gat is a powerful tool designed to automate the exploitation of NTLM relays using ntlmrelayx.py from the Impacket tool suite. By leveraging the capabilities of ntlmrelayx.py, NTLM Relay Gat streamlines the process of exploiting NTLM relay vulnerabilities, offering a range of functionalities from listing SMB shares to executing commands on MSSQL databases.

Features

Multi-threading Support: Utilize multiple threads to perform actions concurrently.
SMB Shares Enumeration: List available SMB shares.
SMB Shell Execution: Execute a shell via SMB.
Secrets Dumping: Dump secrets from the target.
MSSQL Database Enumeration: List available MSSQL databases.
MSSQL Command Execution: Execute operating system commands via xp_cmdshell or start SQL Server Agent jobs.

Prerequisites

Before you begin, ensure you have met the following requirements:

proxychains properly configured with ntlmrelayx SOCKS relay port
Python 3.6+

Installation

To install NTLM Relay Gat, follow these steps:

Ensure that Python 3.6 or higher is installed on your system.
Clone NTLM Relay Git repository:

git clone https://github.com/ad0nis/ntlm_relay_gat.git
cd ntlm_relay_gat

Install dependencies, if you don’t have them installed already:

pip install -r requirements.txt

NTLM Relay Gat is now installed and ready to use.

Usage

To use NTLM Relay Gat, make sure you’ve got relayed sessions in ntlmrelayx.py‘s socks command output and that you have proxychains configured to use ntlmrelayx.py‘s proxy, and then execute the script with the desired options. Here are some examples of how to run NTLM Relay Gat:

[pastacode lang=”markup” manual=”%23%20List%20available%20SMB%20shares%20using%2010%20threads%0Apython%20ntlm_relay_gat.py%20–smb-shares%20-t%2010%0A%0A%23%20Execute%20a%20shell%20via%20SMB%0Apython%20ntlm_relay_gat.py%20–smb-shell%20–shell-path%20%2Fpath%2Fto%2Fshell%0A%0A%23%20Dump%20secrets%20from%20the%20target%0Apython%20ntlm_relay_gat.py%20–dump-secrets%0A%0A%23%20List%20available%20MSSQL%20databases%0Apython%20ntlm_relay_gat.py%20–mssql-dbs%0A%0A%23%20Execute%20an%20operating%20system%20command%20via%20xp_cmdshell%0Apython%20ntlm_relay_gat.py%20–mssql-exec%20–mssql-method%201%20–mssql-command%20’whoami'” message=”” highlight=”” provider=”manual”/]

Source: https://github.com/ad0nis/