PT0-002 Attacks and Exploits Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CrackMapExec

  Why it's wrong here

  CrackMapExec (CME) is a modular post-exploitation toolkit for credential reuse, lateral movement, and reconnaissance across many hosts, but it requires you to already possess valid credentials or hashes. It does not intercept an in-flight NTLM authentication handshake or forward it to another server, so it cannot act as a relay. Its SMB/HTTP modules either authenticate directly or dump credentials, making it a consumer of authentication material rather than a relay attacker.

• ✓

  ntlmrelayx

  Why this is correct

  ntlmrelayx is the core Impacket tool built specifically for NTLM relay: it listens for SMB, HTTP, HTTPS, and other authentication attempts, then relays that challenge-response handshake to a chosen target such as SMB, LDAP, MSSQL, or other protocols. It can automatically perform SMB-signing and EPA checks, dump secrets, create users, or execute commands as the impersonated user, and it optionally integrates with Responder for coerced authentication. This is why it is the dedicated answer for relaying rather than just capturing.

• ✗

  Metasploit

  Why it's wrong here

  Metasploit's auxiliary modules include SMB/HTTP capture and hash-dumping functionality, but its capture modules mainly log and hash-crack rather than transparently forwarding a live authentication handshake to an arbitrary target. There is no mature, purpose-built NTLM relay module in mainstream Metasploit that matches ntlmrelayx's protocol coverage (e.g., HTTP-to-SMB, SMB-to-LDAP with signing/EPA checks). Using Metasploit for relay would require hacky script injection or external plugins, making it the wrong choice versus a dedicated relay framework.

• ✗

  Responder

  Why it's wrong here

  Responder is a poisoning tool that spoofs LLMNR/NBT-NS/mDNS responses to trick victims into sending NTLMv1/NTLMv2 hashes to the attacker, but it stops short of relay. By default, Responder's rogue SMB/HTTP server simply captures the challenge-response and stores it for offline cracking or pass-the-hash reuse; it never forwards that authentication conversation to a real server. To relay, you must disable SMB/HTTP in Responder and feed the network sink to ntlmrelayx, proving Responder alone is only the hash-capture half of the attack.

Go deeper

Related to this question