Check if verbose output is enabled at given level

Get connection timeout from config

Determine if Kerberos should be used for a given target. If --krb-dc-only is set, only use Kerberos for Domain Controllers (

Check if this protocol is relayable (no protections) for CONVENTIONAL NTLM relay. Note: This does NOT apply to NTLM reflection attac

Write session state to disk (atomic: write tmp then rename).

Helper to create a ProtocolResult

Check if an IP address is a valid unicast address for host resolution. Filters out: - Loopback (127.0.0.0/8) - Multicast (224.0.0.0/

Update the current phase and immediately flush.

Extract hostname from various LDAP attribute formats Args: value: String value from LDAP attribute Returns:

Get summary of scan configuration

Get credentials from config

Set the list of DC hostnames (called after AD enumeration)

Store port scan results. Converts sets to lists for JSON.

Check root path and SCCM-specific paths only

Check if /certsrv/ endpoint returns 401

Read LmCompatibilityLevel from remote registry Registry key: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LmCompatibilityLevel

Parse a single target specification

Run fast port scan on targets and return results.

Detect SMTP configuration

Return the set of hosts that have been fully scanned.

Get dynamic RPC endpoint

Fast scan multiple hosts for protocol ports Args: targets: List of target hostnames/IPs protocols: List of p

Calculate impact level for relay to this protocol

Check coercion vulnerabilities across all targets

Quick connectivity check to see if a web server is listening Returns True if server responds, False otherwise

Check DFSCoerce vulnerability

Check which hostnames resolve in DNS

Check for Ghost SPN relay vulnerabilities in Active Directory.

Check if LDAP signing is enforced by attempting bind with signing=False Returns True if signing is required, False if not required, N

Check LDAPS channel binding enforcement using ldap3 (like RelayInformer) Returns True if enforced, False if not enforced, None if unk

Check NTLMv1 support via GPO and/or registry

Check if a specific path requires NTLM authentication

Check PetitPotam vulnerability across multiple pipes

Check if a single port is open Args: host: Target hostname or IP port: Port number Returns:

Check PrinterBug vulnerability

Check if PrintSpooler service is enabled via RPC over TCP Returns True if PrintSpooler is enabled, False otherwise Uses RPC

Return True if any wildcard DNS entry exists in DomainDnsZones.

Special mode: --coerce-all Enumerate AD computers and coerce them all to authenticate to listener

Establish LDAP connection. Returns (conn, use_impacket, search_base). Uses impacket for all auth types: - signing=True on ldap:// s

Deserialize a per-host results dict from JSON storage.

Enumerate computer accounts from Active Directory via LDAP

Alternative AD enumeration using impacket

Enumerate all paths from web_ntlm_paths.dict for NTLM authentication Uses threading for performance

Find a DC from scan results (look for hosts with LDAP available)

Find NTLMv1-specific relay paths based on analysis results. NTLMv1 enables cross-protocol relay attacks because NTLMv1 doesn't suppo

Find relay paths for a specific host

Generate description for relay path

Convert domain to base DN

Query AD for Domain Controllers (members of 'Domain Controllers' group) Returns set of DC hostnames

Convert domain name to LDAP DN format

Return list of dicts with sAMAccountName, servicePrincipalName, distinguishedName.

Get TLS version

Identify SCCM and ADCS servers

Check if user explicitly requested HTTP/HTTPS scanning

Check if a host is a high-value/tier-0 target. Uses LDAP-detected tier-0 assets first (more accurate), falls back to hostnam

Check if a port is open

Check if port is open

Check if Windows version is vulnerable to CVE-2025-33073 Returns: True if vulnerable, False if patched, None if unknown

Check if Windows version is vulnerable to CVE-2019-1040 (Drop the MIC). Returns: True if vulnerable, False if patched or

Parse CIDR notation and expand to individual IPs

Parse targets from file

Parse IP range (e.g., 192.168.1.1-254)

Ping sweep to find live hosts

Resolve all hostnames in parallel. Returns dict: hostname -> list of IPs, or None if unresolvable.

Resolve target hostname to IP address(es) Uses custom DNS server (-ns) and TCP (--dns-tcp) if specified, otherwise falls bac

Serialize a per-host results dict for JSON storage. ProtocolResult objects are converted to dicts; plain dicts (webdav, ntlm_reflection)

Test EPA enforcement using RelayInformer's approach: 1. Try connection with bogus channel binding 2. Try connection with miss

Test HTTPS EPA enforcement using RelayInformer-style detection. Logic (based on RelayInformer): 1. Try with correct/real CBT

Write all Ghost SPN findings to a plaintext file.

Inject up to max_paths Ghost SPN relay paths into analysis['relay_paths']. All findings are capped at max_paths entries in the repor

Analyze all scan results and identify relay paths Args: all_results: dict of {host: {protocol: ProtocolResult, ...}}

Analyze protocol results to identify CVE-2025-33073 vulnerability CVE-2025-33073 (NTLM Reflection) allows relaying FROM SMB TO other

Check given credentials Returns string with: - status: "success" - error: Error message

Check GPO for domain-wide NTLMv1 policy Returns dict with: - enabled: bool (True if NTLMv1 is allowed by GPO)

Run Ghost SPN detection against Active Directory. Returns: dict with keys: 'vulnerable' - list of

Detect WebDAV/WebClient service Returns: dict with 'enabled' bool and optional 'error' str

Detect HTTP/HTTPS configuration If HTTP/HTTPS is explicitly requested (--protocols includes http/https), performs comprehens

Detect LDAP configuration using RelayInformer-style detection

Detect RPC configuration by testing authentication levels Tests in order: CONNECT -> CALL -> PKT_INTEGRITY -> PKT_PRIVACY Th

Detect ADCS (Certificate Authority) servers via LDAP query Based on Certipy logic Returns: Set of ADCS server ho

Detect all tier-0 assets Returns: Set of hostnames (lowercase) that are tier-0 assets

Detect Exchange servers via group membership query Returns: Set of Exchange server hostnames (lowercase)

Detect SCCM servers via LDAP query Based on SCCMHunter logic Returns: Set of SCCM server hostnames (lowercase)

Attempt PetitPotam exploit methods Returns list of successful methods

Attempt PrinterBug exploit Returns list of successful methods

Attempt DFSCoerce exploit methods Returns list of successful methods

Format results as XML

Generate a list of relay targets in URI format for NTLMRelayX. Format: protocol://hostname (or protocol://hostname:port/path for HTTP/HTTPS)

Return deserialized scan results for all completed hosts. Each value is a dict of protocol -> ProtocolResult (or dict for webdav/ntlm

Get the port number for a given protocol