If we can’t crack any hashes from responder, we can gather hashes and simply ‘relay’ them to another machine and authenticate without needing to crack the hashes. Only NTLM can be passed, not NTLMv2

# Requirements

-SMB Signing MUST be disabled on the target

-Relayed creds must be admin on the target

# Begin Attack

The below command will try and initiate a shell once hash has been relayed

./ntlmrelayx.py -tf targets.txt -smb2support -i

# Mitigation