Dominate the domain. Relay to royalty.
RelayKing is a comprehensive relay detection and enumeration tool designed to identify relay attack opportunities in Active Directory environments. Actual reporting options. Comprehensive attack coverage. Find the hidden relay vectors and report in your favorite output format. Feed Impacket's ntlmrelayx.py a curated target list of detected, relay-able hosts. Never miss a critical, exploitable NTLM relay path in the domain again.
See the associated blog released on the Depth Security website for more details: https://www.depthsecurity.com/blog/introducing-relayking-relay-to-royalty/
**RelayKing is NOT AN OPSEC-FRIENDLY TOOL IN CERTAIN MODES, PARTICULARLY IN --audit MODE.
RelayKing is provided AS-IS WITH NO GUARANTEES. See bottom of readme.
# Use a venv. Save yourself the hassle.
# Clone repo:
git clone https://github.com/depthsecurity/RelayKing-Depth.git
#Navigate to cloned dir:
cd RelayKing-Depth/
# Configure Python venv:
virtualenv --python=python3 .
source bin/activate
# Install deps:
pip3 install -r requirements.txt
# Validate RelayKing installation was successful:
python3 relayking.py -h
--remove-mic. Reported as HIGH. Uses the UBR already queried per-host, no additional network requests.--audit mode, queries Active Directory for Service Principal Names whose hostnames have no DNS record. An attacker can register the missing DNS name to intercept NTLM authentication intended for that service principal. Findings are split into vulnerable (no DNS record at all) and probably vulnerable (resolves only via wildcard DNS). Reported as MEDIUM. Full findings written to possible-ghost-spns.txt. Suppress with --no-ghosts.--ntlmv1 or --ntlmv1-all - cross-protocol detection only when confirmed Net-NTLMv1 usage discovered)--remove-mic)possible-ghost-spns.txt(--audit): Enumerate all computers from AD via LDAP. Requires low-priv AD credentials and functional DNS within environment. Force with --dc-ip or edit /etc/resolv.conf.10.0.0.0/24)10.0.0.1-254)python3 relayking.py -u blah -p pass -d domain.local <your_target_ip_or_hostname>)--coerce-all combined with --audit and low-priv creds to coerce EVERY domain machine for mass computer account relaying. Highly useful in environments with Net-NTLMv1 enabled.--ntlmv1 or --ntlmv1-all to detect LanMan GPOs at domain level. --ntlmv1-all checks ALL hosts from AD and their registry values using RemoteRegistry. (requires local admin).--gen-relay-list <file> to produce a readily-importable target file for ntlmrelayx.py's -tf switch.--audit mode when credentials are present. Suppress with --no-ghosts. Full findings are written to possible-ghost-spns.txt alongside the main report; the report itself shows the first 5 to avoid clutter.--dc-ip) should work pretty nicely. If the environment has domain controllers that have NTLM disabled entirely but tolerate it everywhere else, you can use so it doesn't mess with any checks. Also, --dns-tcp and -ns are available for work conducted over SOCKS/other proxy pivots. Even kerb works in this scenario pretty easily.-h, as expected:python3 relayking.py -h
python3 relayking.py -u ‘lowpriv’ -p ‘lowpriv-password’ -d client.domain.local --dc-ip 10.0.0.1 -vv --audit --protocols smb,ldap,ldaps,mssql,http,https --threads 10 -o plaintext,json --output-file relayking-scan --proto-portscan --ntlmv1 --gen-relay-list relaytargets.txt
python3 relayking.py -u ‘lowpriv’ -p ‘lowpriv-password’ -d client.domain.local --dc-ip 10.0.0.1 -vv --audit --protocols smb,ldap,ldaps,mssql -o plaintext,json --output-file relayking-scan --proto-portscan --gen-relay-list relaytargets.txt
python3 relayking.py -u ‘lowpriv’ -p ‘lowpriv-password’ -d client.domain.local -vv --protocols smb,ldap,ldaps,mssql,http,https -o plaintext SERVER1-EXAMPLE.LAB.LOCAL
python3 relayking.py --null-auth -vv --protocols smb,ldap,http -o plaintext 10.0.0.0/24
python3 relayking.py -u ‘lowpriv’ -p ‘lowpriv-password’ -d client.domain.local --dc-ip 10.0.0.1 -vv --audit --protocols smb,ldap,ldaps,mssql,http,https --threads 10 -o plaintext,json --output-file relayking-scan --proto-portscan --ntlmv1-all --gen-relay-list relaytargets.txt
--threads. Each main thread gets worker threads for certain tasks under it. HTTP, for example, uses 20 threads per main thread. This results in ~200 HTTP threads open to scan for HTTP NTLM auth. Most of the time, this is tolerated substantially well but if it causes lag/network issues, reduce the threads. The default of 10 threads is exceptionally quick anyways.--proto-portscan with all your scans. It significantly improves performance and prevents the scanner from waiting for timeouts on ports that aren't actually there. If it causes issues, you can remove at the expensive of scan performance (but it shouldn't!)--max-scangroup, --split-into and --skip can be used to control grouping.--max-scangroup to specify the number of targets for each group. For example, --max-scangroup 100 will split 299 targets into 3 groups. Groups will have targets as 100, 100 and 99.--split-into to specify the number of groups. For example, --split-into 3 will split 299 targets into 3 groups. Groups will have targets as 100, 100 and 99. You cannot specify both --max-scangroup and --split-into in same time.--skip to skip groups. For example, --max-scangroup 3 --skip 1 will split 299 targets into 3 groups as 100, 100 and 99 targets, and skip the first group then starts scanning from second group. It helps when you would like to restart this tool.--ntlmv1 or -ntlmv1-all: Adding --ntlmv1 will pull every LanMan GPO for the domain and nothing else. Requires low-priv AD creds. --ntlmv1-all requires admin credentials and will check every individual host in the domain with SMB open for the LMCompatibilityLevel registry key. Running at least --ntlmv1 is required to show/detect cross-protocol SMB relay paths.
--ntlmv1-all. Also very heavy and not OPSEC safe, but thorough. Probably not recommended unless you’re YOLO’ing or desperate.-o json,plaintext) and --output-file relayking-scan produces relayking-scan.json + relayking-scan.txt so there’s no need to run it twice for multiple formats. Available: plaintext, json, xml, csv, grep, markdown (default: plaintext)--coerce-all functionality will use PetitPotam, DFSCoerce, and PrinterBug on ALL HOSTS TARGETED. It also mass-coerces every machine in the domain without running the full protocol audit. Supplying + at the will perform a domain audit mass-coercion. ()--opsec-safe mode that avoids Impacket/other fingerprinted Python library usage. Not trivial to implement.-vv or -vvv if you're experiencing errors. Logging continues to improve with each version.--audit and RelayKing fails to resolve any hosts in DNS because their DNS server(s) just refuse to resolve their computer FQDNs in the target DNS zone. Not a RelayKing issue.As-is. Many bugs certainly exist. See above. Not designed or intended for illegal/unauthorized activity, obviously.
Consider the behavior & nature of ALL tools you run for a client engagement and on their network(s). This is accomplished by reading tool source and understanding the inner-workings prior to execution, not by blindly executing code you found on GitHub. While I can assure you that there's no deliberately malicious/destructive code inside of RelayKing, validating all novel/unused tools prior to running them is generally speaking, good practice. Trust, but always verify.
Be careful using on red team exercises, especially with authenticated checks and --audit. You WILL get detected and it will be your fault! You should have read the warning at the top of the README if you somehow are reading this sentence and didn't know this already.
While extremely unlikely/improbable, if RelayKing somehow breaks something, you're on your own, and neither the Author or Depth Security are liable for any outcomes/issues/problems/upside-down-geospatial-bit-flipping-nuclear-explosions that could possibly arise (however unlikely) from execution of RelayKing. Your mileage may vary. RelayKing is, once again, provided with NO GUARANTEES OR WARRANTY OF ANY SPECIFIC OUTCOMES, FEATURES, UTILITY, OR BEHAVIOR - EXPLICITLY MENTIONED HERE (AND/OR NOT MENTIONED) OR OTHERWISE IMPLIED.
The only legitimate GitHub repository by the Author (logansdiomedi) is present at https://github.com/depthsecurity/RelayKing-Depth - all others are forks/copies/whatever else, the Author has likely not read, validated, tested, analyzed, or inspected for functionality/behavior/legitimacy. Use your head.
MIT License - see LICENSE file for details
--krb-dc-only--audit--coerce--audit mode only): After the host scan completes, RelayKing queries AD for SPNs whose hostnames have no DNS record. These are candidates for DNS registration attacks that intercept NTLM authentication. The report includes up to 5 findings to keep output manageable; the full list is always written to possible-ghost-spns.txt in the working directory. Pass --no-ghosts to skip this check entirely.--remove-mic flag.