ridter/relayx

Relayx is a security testing tool designed for penetration testers working inside Windows corporate networks (Active Directory environments). It automates a technique called "NTLM relay," which is a way to intercept authentication traffic between Windows machines and redirect it to gain elevated access. The tool bundles several relay-based attacks into one package so testers can move faster during an engagement without juggling multiple separate tools. At a high level, the tool works by tricking a Windows machine into authenticating against the tester's machine instead of (or in addition to) a legitimate server. It can trigger this authentication automatically using known Windows bugs like the "printer bug" or PetitPotam. Once the authentication is captured and relayed, the tool pivots into one of several attack paths depending on what the target is. For example, if the target is an Exchange server, it leverages Exchange's default permissions to grant the tester the ability to extract password hashes from the domain controller. If the target is a regular server, it sets up a technique called resource-based constrained delegation to give the tester an interactive shell on that machine. The primary audience is security professionals conducting authorized penetration tests or red team engagements against Windows domains. Someone might use this when they already have a foothold inside a corporate network and want to escalate their privileges, for instance, turning access to one regular user account into domain-wide control. The tool also supports attacking Active Directory Certificate Services (AD CS) by requesting fraudulent certificates, and a method called "shadow credentials" that works on Windows Server 2016 and newer. The project is built in Python and relies heavily on the Impacket library, which is a standard toolkit for working with Windows network protocols. The README notes that one of the attack paths requires a specific vulnerability (CVE-2019-1040) to be present, and certain methods only work on newer Windows Server versions. The developer states the tool is intended for learning and should not be used illegally.