> For the complete documentation index, see [llms.txt](https://www.impacket.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.impacket.wiki/reference/script-reference/relay-scripts.md).

# Relay Scripts

This group covers scripts that listen for traffic, serve protocol responses, capture authentication, or relay credentials.

## Script List

* `ntlmrelayx.py` -- NTLM relay framework (multi-protocol server/client/attack)
* `smbrelayx.py` -- Legacy SMB-specific relay

## Main Scripts

| Script          | Purpose                                         | What to study                                                |
| --------------- | ----------------------------------------------- | ------------------------------------------------------------ |
| `ntlmrelayx.py` | Relays NTLM authentication to supported targets | Protocol clients, relay server architecture, target handling |
| `smbrelayx.py`  | Legacy SMB-specific relay                       | SMB relay flow                                               |
| `karmaSMB.py`   | SMB capture behavior                            | SMB server responses and credential capture concepts         |
| `smbserver.py`  | Serves a local directory over SMB               | SMB server configuration                                     |
| `sniffer.py`    | Packet sniffer                                  | Packet capture loop and protocol decoding                    |
| `sniff.py`      | Packet sniffing helper                          | Lightweight capture example                                  |
| `kintercept.py` | Intercepts TCP streams                          | Stream interception and forwarding                           |
| `sambaPipe.py`  | Samba named pipe exploit demonstration          | Named pipe behavior                                          |

## NTLMRelayX

`ntlmrelayx.py` is a large example and a framework of its own. It accepts inbound authentication and relays it to one or more target services.

```bash
python examples/ntlmrelayx.py -t smb://files01.contoso.local
python examples/ntlmrelayx.py -tf targets.txt
```

As code, study it in layers:

1. Server setup for inbound protocols.
2. Target selection.
3. Protocol client setup for outbound relay.
4. Attack modules and post-auth actions.
5. Logging, output, and cleanup.

Trying to understand all of `ntlmrelayx.py` at once is difficult. Start with a single inbound protocol and a single target type.

## SMB Server and Capture

`smbserver.py` is a general-purpose SMB server example:

```bash
python examples/smbserver.py -smb2support SHARE C:\Users\Public\share
```

`karmaSMB.py` demonstrates SMB capture-oriented behavior. Use it as a source reference for how SMB server responses can be customized.

## Sniffing and Interception

`sniffer.py`, `sniff.py`, and `kintercept.py` are smaller examples for packet and stream handling.

```bash
python examples/sniffer.py
python examples/kintercept.py
```

These scripts are useful if you want to understand how Impacket structures packet parsing and live network loops outside the more common SMB/Kerberos/LDAP workflows.

## Considerations

Listener and relay tools depend heavily on network placement, name resolution, firewall rules, and target hardening such as SMB signing, LDAP signing, EPA, and channel binding. Treat each script as both a tool and a protocol lab: change one variable at a time and observe the protocol behavior.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.impacket.wiki/reference/script-reference/relay-scripts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.